Secrets Management

Auberge stores all configuration, including sensitive values, in config.toml.

Setup

Generate a config.toml scaffold at the XDG config path:

auberge config init --output "$(auberge config path)"

auberge config init derives the scaffold from the Key Registry (ansible/keys.yml). Without --output, the scaffold is printed to stdout — useful for piping or inspecting available keys. Pass --playbooks <a,b,c> to emit only the keys required by the named playbooks.

Setting Config Values

auberge config set SECRET_NAME value

Required values:

auberge config set admin_user_name yourname
auberge config set admin_user_email you@example.com
auberge config set domain example.com
auberge config set cloudflare_dns_api_token your-token
auberge config set ssh_port 22022

Optional values:

# Only needed for Cockpit web console login
auberge config set admin_user_password your-linux-password

Run auberge config init to print the full list of known keys, each with its documentation string from the Key Registry.

Password Commands

Values prefixed with ! are treated as shell commands. When a config value is consumed (during deploy, backup, or other operations), Auberge runs the command via sh -c and uses the trimmed stdout as the actual value. The command is not evaluated at config set time.

Value formats:

Stored value	Behaviour
!cmd	Runs sh -c "cmd", uses trimmed stdout
!!literal	Stores as !literal (escape hatch - no command is run)
plain string	Used as-is

Example (config.toml):

baikal_admin_password = "!op read op://vault/baikal/password"
cloudflare_dns_api_token = "secret123"
some_literal_bang = "!!not-a-cmd"

Requirements: the command must exit 0 and produce non-empty UTF-8 output. The operation fails with a clear error if either condition is not met.

Viewing Config

auberge config list

Security

• Never commit config.toml to version control - it contains plaintext secrets
• config.toml is listed in .gitignore
• Run auberge config init to print a fresh scaffold derived from the Key Registry

Troubleshooting

“Missing required config value”

auberge config list              # Check what is set
auberge config set KEY value     # Set if missing