Skip to main content
← Back to list
01Issue
FeatureClosedSwamp CLIPublic
AssigneesNone

Relationships

#2084 Unify serve config credential resolution via CEL expressions

Opened by stack72 · 9/9/2026

Summary

Serve config values that reference secrets (webhook trigger secrets, audit sink auth tokens, TLS CA certs) currently use the @vault=/@env=/@file= prefix pattern via resolveSecret() in src/serve/webhook.ts. This works but is a bespoke resolution scheme.

The project already has a CEL runtime (src/domain/expressions/cel_runtime.ts). Unifying credential resolution under CEL would mean:

  • vault.get("integrations", "siem-token") instead of @vault=integrations:siem-token
  • env("SIEM_TOKEN") instead of @env=SIEM_TOKEN
  • file("/path/to/cert") instead of @file=/path/to/cert

This aligns with the expression language used elsewhere in the product and gives operators a single resolution pattern across all config values.

Scope

  • Create a ConfigExpressionResolver that registers vault.get, env, file as CEL functions
  • Migrate webhook trigger secret resolution from resolveSecret() to CEL
  • Migrate audit sink auth resolution to CEL
  • Migrate any other resolveSecret() callers
  • Deprecate the @vault=/@env=/@file= prefix pattern (keep working for backwards compat)
  • Update docs

Context

Filed from Phase 4 audit log work (#2074). The @vault= pattern was kept for Phase 4 to maintain consistency with existing webhook trigger config, but the issue spec originally intended CEL-style resolution.

Automoved by swampadmin from https://github.com/swamp-club/swamp/issues/2422

02Bog Flow
✓OPEN○TRIAGED○IN PROGRESS◉CLOSED

Closed

9/9/2026, 12:24:42 PM

No activity in this phase yet.

03Sludge Pulse
Editable. Press Enter to edit.

bixu commented 9/9/2026, 12:24:59 PM

I love this.

Sign in to post a ripple.