[{"data":1,"prerenderedAt":675},["ShallowReactive",2],{"docs-nav":3,"docs:\u002Fdocs\u002Fconcepts\u002Fenvironments-and-secrets":139},[4,7,10,13,16,19,22,25,28,31,34,37,40,43,46,49,52,55,58,61,64,67,70,73,76,79,82,85,88,91,94,97,100,103,106,109,112,115,118,121,124,127,130,133,136],{"path":5,"title":6},"\u002Fdocs\u002Faccess-gating","Protect a local route",{"path":8,"title":9},"\u002Fdocs\u002Farchitecture\u002Fsecurity-and-trust","Security and trust",{"path":11,"title":12},"\u002Fdocs\u002Fconcepts\u002Fbuilds-and-deployments","Build and deploy",{"path":14,"title":15},"\u002Fdocs\u002Fconcepts\u002Fconfiguration-ownership","Where configuration belongs",{"path":17,"title":18},"\u002Fdocs\u002Fconcepts\u002Fenvironments-and-secrets","Environment values and secrets",{"path":20,"title":21},"\u002Fdocs\u002Fconcepts\u002Fmental-model","How projects fit together",{"path":23,"title":24},"\u002Fdocs\u002Fconcepts\u002Fplans-and-apply","Plans and apply",{"path":26,"title":27},"\u002Fdocs\u002Fconcepts\u002Ftargets-and-runtimes","Choose a target and runtime",{"path":29,"title":30},"\u002Fdocs\u002Fcontribute\u002Freleases","Publish a release",{"path":32,"title":33},"\u002Fdocs\u002Fdevelopment-mounts","Development mounts",{"path":35,"title":36},"\u002Fdocs\u002Fgetting-started","Getting started",{"path":38,"title":39},"\u002Fdocs\u002Fhelp\u002Ffaq","FAQ",{"path":41,"title":42},"\u002Fdocs\u002Fhelp\u002Ftroubleshooting","Troubleshooting",{"path":44,"title":45},"\u002Fdocs\u002Fhow-to\u002Fdeploy-production","Prepare a deployment environment",{"path":47,"title":48},"\u002Fdocs\u002Fhow-to\u002Fswarm-cluster","Run on a multi-node Swarm",{"path":50,"title":51},"\u002Fdocs","mm documentation",{"path":53,"title":54},"\u002Fdocs\u002Fjobs-and-schedules","Jobs and schedules",{"path":56,"title":57},"\u002Fdocs\u002Flocal-dashboard","Local dashboard",{"path":59,"title":60},"\u002Fdocs\u002Flocal-https","Local HTTPS",{"path":62,"title":63},"\u002Fdocs\u002Flocal-services","Local services",{"path":65,"title":66},"\u002Fdocs\u002Fmcp","Let an AI agent work on your project",{"path":68,"title":69},"\u002Fdocs\u002Fmulti-project-hosts","Run multiple projects on one host",{"path":71,"title":72},"\u002Fdocs\u002Fonboarding","Set up a project",{"path":74,"title":75},"\u002Fdocs\u002Fopenbao","Use OpenBao",{"path":77,"title":78},"\u002Fdocs\u002Fproject\u002Fcontributing","Contributing",{"path":80,"title":81},"\u002Fdocs\u002Fproject\u002Flicense","License",{"path":83,"title":84},"\u002Fdocs\u002Fproject\u002Fsecurity","Security",{"path":86,"title":87},"\u002Fdocs\u002Freference\u002Fcapability-matrix","Supported features and platforms",{"path":89,"title":90},"\u002Fdocs\u002Freference\u002Fcli","CLI command reference",{"path":92,"title":93},"\u002Fdocs\u002Freference\u002Fconfiguration","Configuration",{"path":95,"title":96},"\u002Fdocs\u002Freference\u002Fenvironment-variables","Environment variables",{"path":98,"title":99},"\u002Fdocs\u002Freference\u002Ferrors-and-exit-codes","Errors and exit codes",{"path":101,"title":102},"\u002Fdocs\u002Freference\u002Fknown-issues","Known limitations",{"path":104,"title":105},"\u002Fdocs\u002Fremote-access","Manage remote access",{"path":107,"title":108},"\u002Fdocs\u002Fremote-daemon","Set up a remote host",{"path":110,"title":111},"\u002Fdocs\u002Fruntime-observability","Status, logs, and commands",{"path":113,"title":114},"\u002Fdocs\u002Fsecret-delivery","Pass secrets to your app",{"path":116,"title":117},"\u002Fdocs\u002Fsecret-providers","Choose a secret store",{"path":119,"title":120},"\u002Fdocs\u002Fstart\u002Finstall","Install mm",{"path":122,"title":123},"\u002Fdocs\u002Fterminal-ui","Terminal UI",{"path":125,"title":126},"\u002Fdocs\u002Ftutorials\u002Fdotnet-web-api",".NET web API example",{"path":128,"title":129},"\u002Fdocs\u002Ftutorials\u002Ffirst-local-app","First local app",{"path":131,"title":132},"\u002Fdocs\u002Ftutorials\u002Flaravel-rust","Laravel and Rust example",{"path":134,"title":135},"\u002Fdocs\u002Ftutorials\u002Fnode-fullstack","Node full stack example",{"path":137,"title":138},"\u002Fdocs\u002Fvault","Use HashiCorp Vault",{"id":140,"title":18,"body":141,"description":668,"extension":669,"meta":670,"navigation":671,"path":17,"seo":672,"stem":673,"__hash__":674},"docs\u002Fdocs\u002Fconcepts\u002Fenvironments-and-secrets.md",{"type":142,"value":143,"toc":662},"minimark",[144,168,173,180,232,239,376,383,387,390,464,467,522,534,538,575,582,585,610,613,617,643,658],[145,146,147,148,152,153,156,157,152,160,163,164,167],"p",{},"An environment is a named group of settings, such as ",[149,150,151],"code",{},"local"," or ",[149,154,155],{},"production",".\nChoose one with ",[149,158,159],{},"--environment",[149,161,162],{},"MM_ENVIRONMENT","; otherwise mm uses the\nproject's ",[149,165,166],{},"default-environment",".",[169,170,172],"h2",{"id":171},"connect-a-variable-to-a-value","Connect a variable to a value",[145,174,175,176,179],{},"A module's ",[149,177,178],{},".env.example"," can map application variables to logical names:",[181,182,187],"pre",{"className":183,"code":184,"language":185,"meta":186,"style":186},"language-dotenv shiki shiki-themes mm","DB_HOST=localhost # mm:from=DB.HOST required\nDB_PASSWORD= # mm:from=DB.PASSWORD required\nAPP_URL= # mm:from=APP.URL required\n","dotenv","",[149,188,189,210,221],{"__ignoreMap":186},[190,191,194,198,202,206],"span",{"class":192,"line":193},"line",1,[190,195,197],{"class":196},"sRW9m","DB_HOST",[190,199,201],{"class":200},"sIbZ0","=",[190,203,205],{"class":204},"sN9xe","localhost ",[190,207,209],{"class":208},"sP7nD","# mm:from=DB.HOST required\n",[190,211,213,216,218],{"class":192,"line":212},2,[190,214,215],{"class":196},"DB_PASSWORD",[190,217,201],{"class":200},[190,219,220],{"class":208}," # mm:from=DB.PASSWORD required\n",[190,222,224,227,229],{"class":192,"line":223},3,[190,225,226],{"class":196},"APP_URL",[190,228,201],{"class":200},[190,230,231],{"class":208}," # mm:from=APP.URL required\n",[145,233,234,235,238],{},"Add bindings in ",[149,236,237],{},".config\u002Fmm.yaml",". This fragment uses a public hostname, a\nsecret reference, and a URL built from an environment's domain:",[181,240,244],{"className":241,"code":242,"language":243,"meta":186,"style":186},"language-yaml shiki shiki-themes mm","default-environment: local\nbindings:\n  DB.HOST:\n    value: postgres\n  DB.PASSWORD:\n    secret: database.password\nenvironments:\n  local:\n    domains:\n      web: api.example.test\n    bindings:\n      APP.URL:\n        cast: url\n        value-ref: domains.web\n","yaml",[149,245,246,258,266,273,284,292,303,311,319,327,338,346,354,365],{"__ignoreMap":186},[190,247,248,251,254],{"class":192,"line":193},[190,249,166],{"class":250},"sWZmh",[190,252,253],{"class":200},":",[190,255,257],{"class":256},"sv8ni"," local\n",[190,259,260,263],{"class":192,"line":212},[190,261,262],{"class":250},"bindings",[190,264,265],{"class":200},":\n",[190,267,268,271],{"class":192,"line":223},[190,269,270],{"class":250},"  DB.HOST",[190,272,265],{"class":200},[190,274,276,279,281],{"class":192,"line":275},4,[190,277,278],{"class":250},"    value",[190,280,253],{"class":200},[190,282,283],{"class":256}," postgres\n",[190,285,287,290],{"class":192,"line":286},5,[190,288,289],{"class":250},"  DB.PASSWORD",[190,291,265],{"class":200},[190,293,295,298,300],{"class":192,"line":294},6,[190,296,297],{"class":250},"    secret",[190,299,253],{"class":200},[190,301,302],{"class":256}," database.password\n",[190,304,306,309],{"class":192,"line":305},7,[190,307,308],{"class":250},"environments",[190,310,265],{"class":200},[190,312,314,317],{"class":192,"line":313},8,[190,315,316],{"class":250},"  local",[190,318,265],{"class":200},[190,320,322,325],{"class":192,"line":321},9,[190,323,324],{"class":250},"    domains",[190,326,265],{"class":200},[190,328,330,333,335],{"class":192,"line":329},10,[190,331,332],{"class":250},"      web",[190,334,253],{"class":200},[190,336,337],{"class":256}," api.example.test\n",[190,339,341,344],{"class":192,"line":340},11,[190,342,343],{"class":250},"    bindings",[190,345,265],{"class":200},[190,347,349,352],{"class":192,"line":348},12,[190,350,351],{"class":250},"      APP.URL",[190,353,265],{"class":200},[190,355,357,360,362],{"class":192,"line":356},13,[190,358,359],{"class":250},"        cast",[190,361,253],{"class":200},[190,363,364],{"class":256}," url\n",[190,366,368,371,373],{"class":192,"line":367},14,[190,369,370],{"class":250},"        value-ref",[190,372,253],{"class":200},[190,374,375],{"class":256}," domains.web\n",[145,377,378,379,382],{},"Environment bindings override project-wide bindings with the same name.\n",[149,380,381],{},"cast: url"," adds the route's HTTP\u002FHTTPS scheme, defaulting to HTTPS.",[169,384,386],{"id":385},"add-a-secret","Add a secret",[145,388,389],{},"Declare where the value is stored, without putting the password in YAML:",[181,391,393],{"className":241,"code":392,"language":243,"meta":186,"style":186},"secrets:\n  database.password:\n    storage:\n      provider: age\n      location: local\u002Fdatabase-password\n    generate:\n      preset: password\n      length: 40\n",[149,394,395,402,409,416,426,436,443,453],{"__ignoreMap":186},[190,396,397,400],{"class":192,"line":193},[190,398,399],{"class":250},"secrets",[190,401,265],{"class":200},[190,403,404,407],{"class":192,"line":212},[190,405,406],{"class":250},"  database.password",[190,408,265],{"class":200},[190,410,411,414],{"class":192,"line":223},[190,412,413],{"class":250},"    storage",[190,415,265],{"class":200},[190,417,418,421,423],{"class":192,"line":275},[190,419,420],{"class":250},"      provider",[190,422,253],{"class":200},[190,424,425],{"class":256}," age\n",[190,427,428,431,433],{"class":192,"line":286},[190,429,430],{"class":250},"      location",[190,432,253],{"class":200},[190,434,435],{"class":256}," local\u002Fdatabase-password\n",[190,437,438,441],{"class":192,"line":294},[190,439,440],{"class":250},"    generate",[190,442,265],{"class":200},[190,444,445,448,450],{"class":192,"line":305},[190,446,447],{"class":250},"      preset",[190,449,253],{"class":200},[190,451,452],{"class":256}," password\n",[190,454,455,458,460],{"class":192,"line":313},[190,456,457],{"class":250},"      length",[190,459,253],{"class":200},[190,461,463],{"class":462},"s1Wbj"," 40\n",[145,465,466],{},"Then initialize Age, the encrypted local store, and generate the missing value:",[181,468,472],{"className":469,"code":470,"language":471,"meta":186,"style":186},"language-sh shiki shiki-themes mm","mm secret init age\nmm secret generate --missing\nmm secret status database.password\nmm env check\n","sh",[149,473,474,488,501,512],{"__ignoreMap":186},[190,475,476,480,483,486],{"class":192,"line":193},[190,477,479],{"class":478},"svrjQ","mm",[190,481,482],{"class":256}," secret",[190,484,485],{"class":256}," init",[190,487,425],{"class":256},[190,489,490,492,494,497],{"class":192,"line":212},[190,491,479],{"class":478},[190,493,482],{"class":256},[190,495,496],{"class":256}," generate",[190,498,500],{"class":499},"sbRf1"," --missing\n",[190,502,503,505,507,510],{"class":192,"line":223},[190,504,479],{"class":478},[190,506,482],{"class":256},[190,508,509],{"class":256}," status",[190,511,302],{"class":256},[190,513,514,516,519],{"class":192,"line":275},[190,515,479],{"class":478},[190,517,518],{"class":256}," env",[190,520,521],{"class":256}," check\n",[145,523,524,525,528,529,167],{},"To enter an existing password instead, use ",[149,526,527],{},"mm secret set database.password",".\nThe prompt hides your input. Other stores are described in\n",[530,531,533],"a",{"href":532},"..\u002Fsecret-providers","secret providers",[169,535,537],{"id":536},"set-a-workstation-only-value","Set a workstation-only value",[181,539,541],{"className":469,"code":540,"language":471,"meta":186,"style":186},"mm env set DB.HOST localhost\nmm env status\nmm env check\n",[149,542,543,558,567],{"__ignoreMap":186},[190,544,545,547,549,552,555],{"class":192,"line":193},[190,546,479],{"class":478},[190,548,518],{"class":256},[190,550,551],{"class":256}," set",[190,553,554],{"class":256}," DB.HOST",[190,556,557],{"class":256}," localhost\n",[190,559,560,562,564],{"class":192,"line":212},[190,561,479],{"class":478},[190,563,518],{"class":256},[190,565,566],{"class":256}," status\n",[190,568,569,571,573],{"class":192,"line":223},[190,570,479],{"class":478},[190,572,518],{"class":256},[190,574,521],{"class":256},[145,576,577,578,581],{},"This stores a private override, not a project-file edit. Only keys used by a\ntemplate can be overridden. Secret-backed keys must use ",[149,579,580],{},"mm secret set"," instead.",[145,583,584],{},"When several sources provide a variable, the first available value wins:",[586,587,588,598,601,604,607],"ol",{},[589,590,591,592,595,596,167],"li",{},"Service ",[149,593,594],{},"env"," in ",[149,597,237],{},[589,599,600],{},"A secret binding.",[589,602,603],{},"A private workstation override.",[589,605,606],{},"An environment or project public binding.",[589,608,609],{},"The template default.",[145,611,612],{},"An unresolved required value is an error. An optional unset secret may use the\ntemplate default; a provider error does not silently fall back to a public value.",[169,614,616],{"id":615},"how-values-reach-containers","How values reach containers",[181,618,620],{"className":469,"code":619,"language":471,"meta":186,"style":186},"mm env delivery show\nmm env review\n",[149,621,622,634],{"__ignoreMap":186},[190,623,624,626,628,631],{"class":192,"line":193},[190,625,479],{"class":478},[190,627,518],{"class":256},[190,629,630],{"class":256}," delivery",[190,632,633],{"class":256}," show\n",[190,635,636,638,640],{"class":192,"line":212},[190,637,479],{"class":478},[190,639,518],{"class":256},[190,641,642],{"class":256}," review\n",[145,644,645,646,649,650,653,654,167],{},"These show the effective settings without printing secret values. ",[149,647,648],{},"direct","\ndelivery passes values through the runtime process environment; ",[149,651,652],{},"env-file","\nuses temporary private files. Container administrators may still inspect\nenvironment values. If your app supports reading secrets from files, see\n",[530,655,657],{"href":656},"..\u002Fsecret-delivery","secret delivery",[659,660,661],"style",{},"html pre.shiki code .sRW9m, html code.shiki .sRW9m{--shiki-default:var(--mm-code-variable)}html pre.shiki code .sIbZ0, html code.shiki .sIbZ0{--shiki-default:var(--mm-code-punctuation)}html pre.shiki code .sN9xe, html code.shiki .sN9xe{--shiki-default:var(--mm-code-fg)}html pre.shiki code .sP7nD, html code.shiki .sP7nD{--shiki-default:var(--mm-code-comment)}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sWZmh, html code.shiki .sWZmh{--shiki-default:var(--mm-code-key)}html pre.shiki code .sv8ni, html code.shiki .sv8ni{--shiki-default:var(--mm-code-string)}html pre.shiki code .s1Wbj, html code.shiki .s1Wbj{--shiki-default:var(--mm-code-constant)}html pre.shiki code .svrjQ, html code.shiki .svrjQ{--shiki-default:var(--mm-code-function)}html pre.shiki code .sbRf1, html code.shiki .sbRf1{--shiki-default:var(--mm-code-option)}",{"title":186,"searchDepth":212,"depth":212,"links":663},[664,665,666,667],{"id":171,"depth":212,"text":172},{"id":385,"depth":212,"text":386},{"id":536,"depth":212,"text":537},{"id":615,"depth":212,"text":616},"Configure values for local and production environments without committing passwords.","md",{},true,{"title":18,"description":668},"docs\u002Fconcepts\u002Fenvironments-and-secrets","zlERFiikuok7751pKVKTq5sdOz4pG2Z8cIlzCMI8gnI",1794512545911]