valknar/triggershell
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Externalize auth secrets to .env and rename default config to triggershell.yml

Browse Source 
sessionSecret was previously baked directly into the scaffolded config file;
`triggershell init` now generates a .env with TRIGGERSHELL_SESSION_SECRET
instead and references it via ${VAR} interpolation, keeping the actual
secret out of the (often committed) config file. `triggershell dev/start/
validate` load that .env automatically without overriding real env vars.

Also renames the default config filename from triggershell.config.yaml to
triggershell.yml throughout the CLI, app, docs, and examples.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
valknar
2026-08-15 19:15:03 +02:00
co-authored by Claude Sonnet 5
parent ced99a8e75
commit 80c11d3bd3
12 changed files with 126 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/CONFIG_REFERENCE.md
+9 -4
View File
@@ -1,9 +1,14 @@
# Configuration Reference
The config file is YAML, resolved from (in order): `-c/--config`, `TRIGGERSHELL_CONFIG_PATH`, or
`./triggershell.config.yaml`. Values support `${VAR}` / `${VAR:-default}` interpolation against
the CLI's environment, evaluated before YAML parsing. `database.path` and `logs.dir` are resolved
relative to the config file's own directory, not the current working directory.
`./triggershell.yml`. Values support `${VAR}` / `${VAR:-default}` interpolation, evaluated before
YAML parsing. `database.path` and `logs.dir` are resolved relative to the config file's own
directory, not the current working directory.
Before interpolation, the CLI loads a `.env` file from the same directory as the config file (if
present) into its environment - without overriding any variable already set in the shell - so
secrets referenced via `${VAR}` don't have to be committed alongside the config. `triggershell
init` scaffolds both files together.
The canonical schema is the Zod schema at `app/src/lib/config/schema.ts` — this document mirrors
it. `triggershell validate` runs the Python pre-flight checks below, then that full schema.
@@ -21,7 +26,7 @@ it. `triggershell validate` runs the Python pre-flight checks below, then that f
| Field | Type | Default | Notes |
|---|---|---|---|
| `enabled` | boolean | `true` | `false` disables login entirely |
| `sessionSecret` | string | — | Required, >= 32 chars, if `enabled` |
| `sessionSecret` | string | — | Required, >= 32 chars, if `enabled`. Reference it via `${TRIGGERSHELL_SESSION_SECRET}` and set the real value in `.env`, not here |
| `sessionTtlHours` | number | `12` | Session cookie lifetime |
| `users` | array | `[]` | `{username, passwordHash}` — hash via `triggershell users add` |
| `tokens` | array | `[]` | `{name, tokenHash}` — hash via `triggershell users add-token` |