Secrets

Nethera secrets belong to an app. The CLI infers the app context from the current directory where supported, or you can pass --app.

$neth secrets set API_KEY
$neth secrets set API_KEY <secret-value>
$neth secrets set API_KEY --value <secret-value>
$neth secrets list
$neth secrets reveal API_KEY
$neth secrets delete API_KEY

If you omit the value, the CLI prompts without echoing input. Passing the value directly is convenient for scripts, but remember that shell history may record it.

Reference secrets from nethera.yml:

services:
  web:
    image: ghcr.io/acme/app:latest
    nethera:
      secrets:
        - API_KEY

Secrets listed under nethera.secrets are injected as environment variables at deploy time.

Notes

• updating a secret requires a redeploy before running containers see the new value;
• secret values should not be committed to nethera.yml;
• secret values should not be placed in managed files;
• neth secrets reveal can show a stored secret value, so treat terminal output carefully.