skarbiec inject

Invocation#

skarbiec inject <template> <out-file> [--replace]

Purpose#

Keep configuration files — a .env, a database.yml, a kubeconfig — in version control as templates that say where each secret comes from, and write the filled copy only where a program reads it.

Required inputs and options#

• A template file and the file to write; relative paths are taken in the working directory. In the template, {{ skarbiec:<id>:<field> }} names one text field of one item, spaces inside the braces optional, the field split off at the last colon; any other {{ … }} is left as written, for whatever else reads the template. --replace allows writing over an existing file. POST /v1/operator/inject takes template, out and replace, both paths absolute on the machine serving the API, and is never forwarded to a remote vault owner.

Output and state effects#

• Reads every reference before anything is written, then writes the template with each reference replaced by its value as an owner-only file, through a temporary beside it renamed into place, so a reader never sees half a file. Appends an inject journal record naming the template, the file and each reference with its line, item and field — never a value — and prints ok, template, out and references. Desktop's Settings → Policy has Fill a template….

Refusals#

• Anything but two paths exits 2 with the usage, and an out-file that is the template exits 2. An existing out-file is refused with `<out> exists; --replace overwrites it, else name a new file`; a template naming no reference with `<template> names no {{ skarbiec:<id>:<field> }}, so there is nothing to fill`; a reference without an id or field with `line <n>: {{ … }} is not {{ skarbiec:<id>:<field> }}`; an item that does not exist or will not open with its line and error, and a field the item lacks with `line <n>: <id> has no text field <field>`. In each case nothing is written. A template that cannot be read fails naming it.

Examples#

# .env.template, committed DATABASE_URL=postgres://app:{{ skarbiec:prod-db:password }}@db.internal/app STRIPE_KEY={{ skarbiec:stripe:credential }} skarbiec inject .env.template .env --replace