1# Secrets Commands
2
3Manage secrets on local or remote Gordon instances.
4
5Storage depends on the secrets backend:
6- `pass`: secrets are stored in pass under `gordon/env/<domain>/<KEY>`
7- `sops` or `unsafe`: secrets are stored in domain `.env` files
8
9## gordon secrets
10
11### Subcommands
12
13| Subcommand | Description |
14|------------|-------------|
15| `list` | List all secrets for a domain |
16| `set` | Set a secret value |
17| `remove` | Remove a secret |
18
19---
20
21## gordon secrets list
22
23List all secrets for a specific domain.
24
25```bash
26gordon secrets list <domain>
27```
28
29### Arguments
30
31| Argument | Description |
32|----------|-------------|
33| `<domain>` | The domain name to list secrets for |
34
35### Options
36
37| Option | Description |
38|--------|-------------|
39| `--remote` | Remote Gordon URL |
40| `--token` | Authentication token for remote |
41
42### Examples
43
44```bash
45# Local
46gordon secrets list myapp.local
47
48# Remote
49gordon secrets list myapp.local --remote https://gordon.mydomain.com --token $TOKEN
50```
51
52### Output
53
54```
55Secret                    Value (masked)
56--------------------------------------------------------------------------------
57DATABASE_URL              postgres://...
58API_KEY                   ****
59JWT_SECRET                ****
60```
61
62---
63
64## gordon secrets set
65
66Set a secret value for a domain.
67
68```bash
69gordon secrets set <domain> <key> <value>
70gordon secrets set myapp.local DATABASE_URL "postgres://..."
71```
72
73### Arguments
74
75| Argument | Description |
76|----------|-------------|
77| `<domain>` | The domain name to set the secret for |
78| `<key>` | The secret key (environment variable name) |
79| `<value>` | The secret value |
80
81### Options
82
83| Option | Description |
84|--------|-------------|
85| `--remote` | Remote Gordon URL |
86| `--token` | Authentication token for remote |
87
88### Examples
89
90```bash
91# Local
92gordon secrets set myapp.local DATABASE_URL "postgres://user:pass@postgres:5432/db"
93gordon secrets set myapp.local API_KEY "your-api-key"
94
95# Remote
96gordon secrets set myapp.local DATABASE_URL "postgres://..." --remote https://gordon.mydomain.com --token $TOKEN
97```
98
99---
100
101## gordon secrets remove
102
103Remove a secret from a domain.
104
105```bash
106gordon secrets remove <domain> <key>
107```
108
109### Arguments
110
111| Argument | Description |
112|----------|-------------|
113| `<domain>` | The domain name |
114| `<key>` | The secret key to remove |
115
116### Options
117
118| Option | Description |
119|--------|-------------|
120| `--remote` | Remote Gordon URL |
121| `--token` | Authentication token for remote |
122
123### Examples
124
125```bash
126# Local
127gordon secrets remove myapp.local DATABASE_URL
128
129# Remote
130gordon secrets remove myapp.local DATABASE_URL --remote https://gordon.mydomain.com --token $TOKEN
131```
132
133---
134
135## Workflow Examples
136
137### Setting Up Application Secrets
138
139```bash
140# Database connection
141gordon secrets set myapp.local DATABASE_URL "postgres://user:pass@postgres:5432/mydb"
142
143# API keys
144gordon secrets set myapp.local STRIPE_KEY "sk_live_..."
145gordon secrets set myapp.local SENDGRID_KEY "SG..."
146
147# JWT secret
148gordon secrets set myapp.local JWT_SECRET "your-jwt-secret-here"
149
150# Verify
151gordon secrets list myapp.local
152```
153
154### CI/CD Secret Management
155
156```bash
157# In your CI/CD pipeline
158export GORDON_REMOTE=https://gordon.mydomain.com
159export GORDON_TOKEN=$GORDON_TOKEN
160
161# Update secrets before deploy
162gordon secrets set myapp.example.com DATABASE_URL "$DATABASE_URL"
163gordon secrets set myapp.example.com API_KEY "$API_KEY"
164
165# Deploy
166gordon routes deploy myapp.example.com
167```
168
169### Rotating Secrets
170
171```bash
172# Generate new secret
173NEW_JWT_SECRET=$(openssl rand -base64 32)
174
175# Update the secret
176gordon secrets set myapp.local JWT_SECRET "$NEW_JWT_SECRET"
177
178# Redeploy to pick up new secret
179gordon routes deploy myapp.local
180```
181
182## Related
183
184- [CLI Overview](./index.md)
185- [Secrets Configuration](../config/secrets.md)
186- [Environment Variables](../config/env.md)