Secrets & Environment Variables

FluxNow supports two types of configuration values: environment variables and secrets. Both are injected into your containers at deploy time.

Environment variables vs secrets

	Environment variables	Secrets
Visibility	Visible in the dashboard	Encrypted at rest; not visible after saving
Use cases	Non-sensitive config, feature flags, URLs	API keys, tokens, database passwords
Storage	Plaintext	Encrypted via OpenBao

Environment variables

Declare non-sensitive env vars inline in fluxnow.yaml under spec.env:

fluxnow.yaml

spec:
  runtime: node
  env:
    - name: FEATURE_X
      value: "true"
    - name: PUBLIC_API_URL
      value: https://api.example.com

Secrets

Declare secrets under spec.secrets. Each has a name (the env var injected into your container) and a key in category/property form that points at the value in FluxNow’s secrets store (backed by OpenBao):

fluxnow.yaml

spec:
  secrets:
    - name: STRIPE_API_KEY
      key: stripe/api-key
    - name: TELEGRAM_TOKEN
      key: telegram/token

The secret values never live in your repo — only the reference does. Today, the values are provisioned into the secrets store for you by the FluxNow team when you declare a new secret (reach out with the value); a self-serve dashboard for managing them is on the roadmap. Once set, the value is injected into your container under name and picked up on the next deploy.

Adding a single secret

Just need one — say the decryption key for dotenvx? Add one entry under spec.secrets:

fluxnow.yaml

spec:
  secrets:
    - name: DOTENV_PRIVATE_KEY      # the env var your app reads
      key: dotenvx/private-key       # reference to the value in the secrets store

Then hand the key value to the FluxNow team to store under that reference. On the next deploy it lands in your container as DOTENV_PRIVATE_KEY. (In a monorepo, put secrets under the specific app’s spec, not the repo root.)

Auto-injected service credentials

Connection details for provisioned services are injected automatically — do not set these yourself:

• DATABASE_URL (plus PG*, POSTGRES_*, JDBC_URL aliases) — Postgres
• REDIS_URL / REDIS_HOST / REDIS_PORT / REDIS_PASSWORD / REDIS_TLS (and KV_URL) — Redis
• S3_* / AWS_* / BUCKET_NAME — S3 storage

See the Environment Variables reference for the complete per-service list and code examples.

Injection at deploy time

All configured values are injected into your container as environment variables when the container starts. Changes take effect on the next deploy.