Skip to main content
← Back to list
01Issue
FeatureOpenSwamp CLIPublicTeam
AssigneesNone

Relationships

#1801 Datastore config should support vault expressions or env var references for tokens

Opened by webframp · 8/24/2026

Problem

Datastore config in .swamp.yaml requires literal token values. Vault expressions (${{ vault.get(...) }}) are only resolved in model definitions, not at the datastore layer. This means any token-based datastore (gitlab-datastore, or anything not using ambient credential chains) forces a plaintext secret into a committed file.

Impact

  • .swamp.yaml is committed to git (it holds repo metadata, tool list, version)
  • Operators must choose between: committing secrets, gitignoring .swamp.yaml entirely, or using git skip-worktree hacks
  • The share guide's vault migration flow doesn't help because the datastore bootstraps before vault resolution
  • S3/GCS datastores avoid this by using ambient credential chains, but GitLab/DynamoDB/Postgres with static creds all hit this

Proposed Solution

Support at minimum one of:

  1. Environment variable interpolation in datastore config: ${{ env.GITLAB_TOKEN }} or ${GITLAB_TOKEN}
  2. Vault expression resolution at the datastore layer (resolve vault before datastore init)
  3. A 'credential' field that points to a vault+key pair, resolved specially by the datastore setup

Option 1 is simplest and solves the bootstrap problem without circular dependencies. The token comes from the operator's environment (direnv, shell profile, 1Password CLI, etc.) and .swamp.yaml stays secret-free.

Workaround

Currently using git update-index --skip-worktree on .swamp.yaml and documenting the manual datastore setup step per operator.

02Bog Flow
◉OPEN○TRIAGED○IN PROGRESS○SHIPPED

Open

8/24/2026, 12:42:01 AM

No activity in this phase yet.

03Sludge Pulse

Sign in to post a ripple.