1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
# yaml-language-server: $schema=https://raw.githubusercontent.com/ffimnsr/mk-rs/main/docs/schema.json
#
# Examples showing secrets: block usage.
#
# Run: mk secrets vault init --write-config
# to auto-populate the secrets: block after vault creation.
# --- Example 1: Root defaults (built-in PGP backend) ---
#
# All tasks inherit these settings unless they supply their own secrets: block.
secrets:
vault_location: ./.mk/vault
keys_location: ~/.config/mk/priv
key_name: default
tasks:
# Uses root secrets: defaults — no per-task override needed.
print-node-env:
description: Print NODE_ENV from a secrets_path file
secrets:
secrets_path:
- app/development/env
commands:
- command: env | grep '^NODE_ENV='
verbose: false
# --- Example 2: Task-level override ---
#
# Inherits vault_location and keys_location from root but uses a different key_name.
deploy-prod:
description: Deploy using production key
secrets:
key_name: prod-key
secrets_path:
- app/production/env
environment:
DB_PASS: ${{ secrets.app/database/password }}
commands:
- command: echo "deploying with $DB_PASS"
verbose: false
# --- Example 3: GPG backend ---
#
# Override backend to gpg for this task; all crypto goes through the system gpg binary.
# gpg_key_id is required when backend = "gpg".
deploy-gpg:
description: Deploy using YubiKey-backed GPG key
secrets:
backend: gpg
vault_location: ./.mk/vault
gpg_key_id: YOUR_KEY_FINGERPRINT
secrets_path:
- app/production/env
commands:
- command: echo "deploying via gpg"
verbose: false