Environment variables and secrets

Everything an app reads from its environment lives on the app’s Environment tab: your own variables, shared secrets from Plexivo Secrets, and connections to your databases and caches.

Environment variables#

1. Add. On the Environment tab, choose + Add variable, enter the Key and Value, then Add.
2. Review. Add, change or remove as many as you need. Nothing is saved yet.
3. Apply. Review the changes and apply them. Plexivo restarts the app’s instances onto the new values one at a time. Each old instance keeps serving until its replacement is ready.

• Names use letters, digits and underscores, and do not start with a digit: STRIPE_KEY, LOG_LEVEL.
• Values are encrypted at rest. Keys that look like secrets, such as …_TOKEN or DATABASE_URL, stay masked until you choose Show.
• Reading the values needs permission to manage the organisation, and each read is recorded in the audit log.
• If someone else saved the environment after you opened it, your save is refused and nothing changes. Reload, then apply your change again.

With the API#

The API replaces the whole set at once. Read it first, then send it back with your change and the version you read.

curl -s $API/deployments/$APP/env -H "Authorization: Bearer $PLEXIVO_TOKEN"
# {"env": {"LOG_LEVEL": "info"}, "version": "…"}

curl -s -X PUT $API/deployments/$APP/env \
  -H "Authorization: Bearer $PLEXIVO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"env": {"LOG_LEVEL": "debug"}, "expected_version": "VERSION_YOU_READ"}'

Secrets from Plexivo Secrets#

Keep API keys and passwords you share across apps in Plexivo Secrets. On the Environment tab, in Secrets, choose Attach a secret…, pick it and choose Attach. Each attached secret shows its Variable, the secret it comes from (From secret) and its Version.

When you change the secret in Secrets, the app picks up the new version. A variable an attached secret sets is changed there, not on the Environment tab.

Connect a database or cache#

In Add a database or cache, choose the Resource and Connect. Plexivo delivers its connection details as variables and restarts the app once they are ready.

• When the password rotates, the variables follow. You never copy a password by hand.
• A resource in the same project is reached over the private network. Others may be reached over the internet, always with TLS.
• Point your client at the CA certificate in the …_CA_CERT variable. Never turn off TLS verification.

Set by Plexivo#

• PORT: the port to listen on. See Listen on PORT.
• TZ: your organisation’s time zone, India Standard Time for India, unless you set TZ yourself.

The start command is your Dockerfile’s CMD, or the one Plexivo detected when it built your code.

Next steps#