Environment values and secrets

An environment is a named group of settings, such as local or production. Choose one with --environment or MM_ENVIRONMENT; otherwise mm uses the project's default-environment.

Connect a variable to a value#

A module's .env.example can map application variables to logical names:

DB_HOST=localhost # mm:from=DB.HOST required
DB_PASSWORD= # mm:from=DB.PASSWORD required
APP_URL= # mm:from=APP.URL required

Add bindings in .config/mm.yaml. This fragment uses a public hostname, a secret reference, and a URL built from an environment's domain:

default-environment: local
bindings:
  DB.HOST:
    value: postgres
  DB.PASSWORD:
    secret: database.password
environments:
  local:
    domains:
      web: api.example.test
    bindings:
      APP.URL:
        cast: url
        value-ref: domains.web

Environment bindings override project-wide bindings with the same name. cast: url adds the route's HTTP/HTTPS scheme, defaulting to HTTPS.

Add a secret#

Declare where the value is stored, without putting the password in YAML:

secrets:
  database.password:
    storage:
      provider: age
      location: local/database-password
    generate:
      preset: password
      length: 40

Then initialize Age, the encrypted local store, and generate the missing value:

mm secret init age
mm secret generate --missing
mm secret status database.password
mm env check

To enter an existing password instead, use mm secret set database.password. The prompt hides your input. Other stores are described in secret providers.

Set a workstation-only value#

mm env set DB.HOST localhost
mm env status
mm env check

This stores a private override, not a project-file edit. Only keys used by a template can be overridden. Secret-backed keys must use mm secret set instead.

When several sources provide a variable, the first available value wins:

1. Service env in .config/mm.yaml.
2. A secret binding.
3. A private workstation override.
4. An environment or project public binding.
5. The template default.

An unresolved required value is an error. An optional unset secret may use the template default; a provider error does not silently fall back to a public value.

How values reach containers#

mm env delivery show
mm env review

These show the effective settings without printing secret values. direct delivery passes values through the runtime process environment; env-file uses temporary private files. Container administrators may still inspect environment values. If your app supports reading secrets from files, see secret delivery.