1# Secrets Commands
2
3Manage secrets on local or remote Gordon instances.
4
5## gordon secrets
6
7### Subcommands
8
9| Subcommand | Description |
10|------------|-------------|
11| `list` | List all secrets for a domain |
12| `set` | Set a secret value |
13| `remove` | Remove a secret |
14
15---
16
17## gordon secrets list
18
19List all secrets for a specific domain.
20
21```bash
22gordon secrets list <domain>
23```
24
25### Arguments
26
27| Argument | Description |
28|----------|-------------|
29| `<domain>` | The domain name to list secrets for |
30
31### Options
32
33| Option | Description |
34|--------|-------------|
35| `--remote` | Remote Gordon URL |
36| `--token` | Authentication token for remote |
37
38### Examples
39
40```bash
41# Local
42gordon secrets list myapp.local
43
44# Remote
45gordon secrets list myapp.local --remote https://gordon.mydomain.com --token $TOKEN
46```
47
48### Output
49
50```
51Secret                    Value (masked)
52--------------------------------------------------------------------------------
53DATABASE_URL              postgres://...
54API_KEY                   ****
55JWT_SECRET                ****
56```
57
58---
59
60## gordon secrets set
61
62Set a secret value for a domain.
63
64```bash
65gordon secrets set <domain> <key> <value>
66gordon secrets set myapp.local DATABASE_URL "postgres://..."
67```
68
69### Arguments
70
71| Argument | Description |
72|----------|-------------|
73| `<domain>` | The domain name to set the secret for |
74| `<key>` | The secret key (environment variable name) |
75| `<value>` | The secret value |
76
77### Options
78
79| Option | Description |
80|--------|-------------|
81| `--remote` | Remote Gordon URL |
82| `--token` | Authentication token for remote |
83
84### Examples
85
86```bash
87# Local
88gordon secrets set myapp.local DATABASE_URL "postgres://user:pass@postgres:5432/db"
89gordon secrets set myapp.local API_KEY "your-api-key"
90
91# Remote
92gordon secrets set myapp.local DATABASE_URL "postgres://..." --remote https://gordon.mydomain.com --token $TOKEN
93```
94
95---
96
97## gordon secrets remove
98
99Remove a secret from a domain.
100
101```bash
102gordon secrets remove <domain> <key>
103```
104
105### Arguments
106
107| Argument | Description |
108|----------|-------------|
109| `<domain>` | The domain name |
110| `<key>` | The secret key to remove |
111
112### Options
113
114| Option | Description |
115|--------|-------------|
116| `--remote` | Remote Gordon URL |
117| `--token` | Authentication token for remote |
118
119### Examples
120
121```bash
122# Local
123gordon secrets remove myapp.local DATABASE_URL
124
125# Remote
126gordon secrets remove myapp.local DATABASE_URL --remote https://gordon.mydomain.com --token $TOKEN
127```
128
129---
130
131## Workflow Examples
132
133### Setting Up Application Secrets
134
135```bash
136# Database connection
137gordon secrets set myapp.local DATABASE_URL "postgres://user:pass@postgres:5432/mydb"
138
139# API keys
140gordon secrets set myapp.local STRIPE_KEY "sk_live_..."
141gordon secrets set myapp.local SENDGRID_KEY "SG..."
142
143# JWT secret
144gordon secrets set myapp.local JWT_SECRET "your-jwt-secret-here"
145
146# Verify
147gordon secrets list myapp.local
148```
149
150### CI/CD Secret Management
151
152```bash
153# In your CI/CD pipeline
154export GORDON_REMOTE=https://gordon.mydomain.com
155export GORDON_TOKEN=$GORDON_TOKEN
156
157# Update secrets before deploy
158gordon secrets set myapp.example.com DATABASE_URL "$DATABASE_URL"
159gordon secrets set myapp.example.com API_KEY "$API_KEY"
160
161# Deploy
162gordon routes deploy myapp.example.com
163```
164
165### Rotating Secrets
166
167```bash
168# Generate new secret
169NEW_JWT_SECRET=$(openssl rand -base64 32)
170
171# Update the secret
172gordon secrets set myapp.local JWT_SECRET "$NEW_JWT_SECRET"
173
174# Redeploy to pick up new secret
175gordon routes deploy myapp.local
176```
177
178## Related
179
180- [CLI Overview](./index.md)
181- [Secrets Configuration](../config/secrets.md)
182- [Environment Variables](../config/env.md)