Outside the lab¶

A lesson that calls an API needs a key. The key stays out of the git repository, and it stays off the disk. The lab receives the key when a sitting starts.

In config.yaml, name the variable the lesson will read. A value that starts with $ is copied from outside the lab. Those outside names are the environment, the variables already set for the program that starts the lab.

env:
  API_TOKEN: $API_TOKEN

The name on the left is the variable inside the lab. The name after $ is the variable outside. They can be the same word. If the outside variable is missing or empty, the lab does not start.

On the machine, the value is placed in the shell for that sitting. It is written to /root/.lab-env on that machine only. The disk image does not contain it.

Try it locally¶

Set the variable in your shell. sudo drops the environment unless you tell it which name to keep:

sudo --preserve-env=API_TOKEN ./trylab your-lab

Save it for learners¶

runlabctl stores the value for the account you published with. The command reads the value from the terminal and does not print it.

./runlabctl login
./runlabctl secret add API_TOKEN

login opens a browser on the site. Sign in, and close the window when it says you can. secret add then asks for the value.

When a learner opens the lab, the variable is set from the value saved for the account that connected the repository. A lab that is already open keeps the value it started with.

The reference lists every config.yaml field, the lesson markup, and the commands. Replacing a value, removing one, and listing the names you have stored are on the secrets page.