Secrets¶
runlabctl stores a secret for the account that publishes a lab. It also writes a copy for local use. Values are read from the terminal and are not printed. secret list prints names only.
Run it from the pack directory.
./runlabctl login
./runlabctl logout
./runlabctl whoami
./runlabctl secret list
./runlabctl secret add NAME
./runlabctl secret update NAME
./runlabctl secret delete NAME
login opens a browser page on the site where you publish. A local page then says you are signed in, and you can close it. The sign-in is kept under ~/.config/runlab/. logout deletes that sign-in. whoami prints the email of the signed-in account.
secret add and secret update prompt with Value: when the terminal is interactive. A pipe takes one line instead. An empty value is refused. update replaces the stored value of an existing name. delete removes the name.
The name has to be a shell variable: a letter or underscore, then letters, digits, and underscores.
The stored value is the one a published lab receives, for the account that connected the repository. The catalog sends a lab only the names that lab lists under env. A missing name stops the launch before the machine boots. A lab that is already open keeps the values it started with.
On the lab machine the values are written to /root/.lab-env for that sitting. The disk image does not contain them.
secret add, secret update, and secret delete also update ~/.config/runlab/lab-env for the account that ran runlabctl. A local sudo ./trylab runs as root, so it does not read that file. Pass the name through sudo instead, as Commands shows.
In config.yaml, point the lab at the outside variable:
A value with no leading $ is stored in the file as plain text. Keep a secret in the $ form.