Secrets

A module that needs a credential — a database password, an API token, a provider key — leaves it on the machine that uses it. Not on the platform, and not in the app.

Where they live

In one file, /etc/pupitre/env, readable by root alone. The agent runs as root and reads it when it has to; nothing else on the machine can. A value gets there in one way: it travels on the standard input of the SSH session, on the protocol’s own line for secrets, so it is never part of a request that could be logged.

How one gets there

You type it once, in the module’s configuration — at install time, or later. The value crosses to the app’s main process and goes straight onto that secret line. It is not kept in the app, not written to a log, and not shown again afterwards.

A secret field can also be generated for you. What is generated is written on the server and never displayed: you retrieve it from the service’s page, which shows one credential at a time and copies it without printing it anywhere.

Accounts, not servers

Some credentials are the same on every machine: a GitHub token, a 1Password service account, a Neon key, a Cloudflare token. Those are connected once, as an account, in the app’s settings or above the module’s own questions. The app keeps them in your computer’s keychain, checks them as you paste them where the provider can be asked, and fills the module’s field itself at install time.

Nothing changes about how they reach the machine. The token travels on the install’s secret line like any other, and lands in the same root-only file. What changes is that you type it once rather than once per server — and that a module whose account is not connected is refused before the first step, instead of failing on the machine.

Changing one

Open the service, and apply its configuration again. The form is the module’s own, filled with what the agent kept from the last installation; a secret left empty stays the one the server already holds, and a secret retyped replaces it.

Going through the module rather than through the file is what makes the change real: a database password lives both in the file and inside the database, and only the module changes both.

What the app never does

It does not keep a copy, it does not send one to the platform, and it does not put one in a log. The rule is the same as everywhere else in Pupitre: a secret exists on your laptop for as long as you are typing it, and on your server afterwards.