# Secrets Management
Auberge stores all configuration, including sensitive values, in `config.toml`.
## Setup
Generate a `config.toml` scaffold at the XDG config path:
```bash
auberge config init --output "$(auberge config path)"
```
`auberge config init` derives the scaffold from the Key Registry
(`ansible/keys.yml`). Without `--output`, the scaffold is printed to stdout —
useful for piping or inspecting available keys. Pass `--playbooks <a,b,c>`
to emit only the keys required by the named playbooks.
## Setting Config Values
```bash
auberge config set SECRET_NAME value
```
**Required values:**
```bash
auberge config set hostname yourserver
auberge config set admin_user_name yourname
auberge config set admin_user_email you@example.com
auberge config set domain example.com
auberge config set cloudflare_dns_api_token your-token
auberge config set ssh_port 22022
```
**Optional values:**
```bash
# Only needed for Cockpit web console login
auberge config set admin_user_password your-linux-password
```
Run `auberge config init` to print the full list of known keys, each with
its documentation string from the Key Registry.
## Password Commands
Values prefixed with `!` are treated as shell commands. When a config value is consumed (during deploy, backup, or other operations), Auberge runs the command via `sh -c` and uses the trimmed stdout as the actual value. The command is **not** evaluated at `config set` time.
**Value formats:**
| `!cmd` | Runs `sh -c "cmd"`, uses trimmed stdout |
| `!!literal` | Stores as `!literal` (escape hatch - no command is run) |
| `plain string` | Used as-is |
**Example (`config.toml`):**
```toml
baikal_admin_password = "!op read op://vault/baikal/password"
cloudflare_dns_api_token = "secret123"
some_literal_bang = "!!not-a-cmd"
```
**Requirements:** the command must exit 0 and produce non-empty UTF-8 output. The operation fails with a clear error if either condition is not met.
## Viewing Config
```bash
auberge config list
```
## Security
- Never commit `config.toml` to version control - it contains plaintext secrets
- `config.toml` is listed in `.gitignore`
- Run `auberge config init` to print a fresh scaffold derived from the Key Registry
## Troubleshooting
**"Missing required config value"**
```bash
auberge config list # Check what is set
auberge config set KEY value # Set if missing
```