Secret
Configuring a Secret source allows you to pull keys, passwords, or any other sensitive value from an external secret store rather than placing them in your configuration directly. This is similar to the way you can reference environmental variables. Secrets loaded in this way are never written to disk. Properly externalizing secrets allows you to place your configuration into source control without modification.
Description
Once a Secret source is configured, you can utilize it by including a configuration value like secret.key-name. The secret source will then be queried for a secret named key-name. If the secret store has no secret by that name, it will prevent the application from starting up. This effect applies to any other "entity" (cache, authentication, provider), for obvious reasons you can’t use a secret in the configuration for your secret source.
Secret values are resolved when the application starts and when the configuration is reloaded. Tilegroxy can watch for changes to your secrets, which will trigger a zero-downtime reload (this reloads all secrets (and everything else), not just the one that changed). This is controlled by the watch parameter and defaults off (this is independent of --hot-reload cli flag for configuration hot loading).
Configuration
| Parameter | Description | Type | Required | Default |
|---|---|---|---|---|
|
Whether to check watched secrets for changes and reload when one of them rotates |
bool |
No |
false |
|
How often to check for changes, in seconds. Only valid when watch is true |
int |
No |
300 |
|
How often to reload all secrets regardless of whether a change was detected, in seconds. Disabled when 0. Only valid when watch is true |
int |
No |
0 |