NovopsConfigFile

Type: object

Main Novops config file

root config

Global configurations for Novops and modules

root config anyOf NovopsConfig
Type: object

Global Novops configuration defining behavior for modules

root config anyOf item 0 aws

AWS module configs

root config anyOf item 0 aws anyOf AwsConfig
Type: object

Global AWS config

root config anyOf item 0 aws anyOf item 0 endpoint
Type: string or null

Override endpoint for all AWS services Can be used with tools like LocalStack, for example http://localhost:4566/

root config anyOf item 0 aws anyOf item 0 identity_cache

AWS SDK identity cache configuration

root config anyOf item 0 aws anyOf item 0 identity_cache anyOf IdentityCache
Type: object

AWS SDK identity cache configuration

root config anyOf item 0 aws anyOf item 0 identity_cache anyOf item 0 load_timeout
Type: integer or nullFormat: uint64

Timeout to load identity (in seconds, default: 5s). Useful when asking for MFA authentication which may take more than 5 seconds for user to input.
root config anyOf item 0 aws anyOf item 0 identity_cache anyOf item 1
Type: null

root config anyOf item 0 aws anyOf item 0 profile
Type: string or null

AWS Profile name. Must exist locally in AWS config.

It's advised not to use this directly as profile name configuration is higly dependent on local configuration. Prefer using AWS_PROFILE environment variable where needed.

root config anyOf item 0 aws anyOf item 0 region
Type: string or null

AWS region to use. Default to currently configured region.
root config anyOf item 0 aws anyOf item 1
Type: null

root config anyOf item 0 default

Novops default configurations

root config anyOf item 0 default anyOf NovopsConfigDefault
Type: object

root config anyOf item 0 default anyOf item 0 environment
Type: string or null

Default environment name, selected by default if no user input is provided
root config anyOf item 0 default anyOf item 1
Type: null

root config anyOf item 0 hashivault

Hashicorp Vault module configs

root config anyOf item 0 hashivault anyOf HashivaultConfig
Type: object

root config anyOf item 0 hashivault anyOf item 0 address
Type: string or null

Address in form http(s)://HOST:PORT

Example: https://vault.mycompany.org:8200

root config anyOf item 0 hashivault anyOf item 0 auth

Vault authentication to use when a token is not provided

root config anyOf item 0 hashivault anyOf item 0 auth anyOf HashiVaultAuth
Type: object

root config anyOf item 0 hashivault anyOf item 0 auth anyOf item 0 oneOf item 0
Type: object

root config anyOf item 0 hashivault anyOf item 0 auth anyOf item 0 oneOf item 0 type
Type: enum (of string)

Must be one of:

  • "Kubernetes"
root config anyOf item 0 hashivault anyOf item 0 auth anyOf item 0 oneOf item 1
Type: object

root config anyOf item 0 hashivault anyOf item 0 auth anyOf item 0 oneOf item 1 type
Type: enum (of string)

Must be one of:

  • "AppRole"
root config anyOf item 0 hashivault anyOf item 0 auth anyOf item 0 oneOf item 2
Type: object

root config anyOf item 0 hashivault anyOf item 0 auth anyOf item 0 oneOf item 2 type
Type: enum (of string)

Must be one of:

  • "JWT"
root config anyOf item 0 hashivault anyOf item 0 auth anyOf item 1
Type: null

root config anyOf item 0 hashivault anyOf item 0 namespace
Type: string or null

Vault namespace to use

root config anyOf item 0 hashivault anyOf item 0 timeout
Type: integer or nullFormat: uint64

Vault client timeout in seconds. Default to 60s.

root config anyOf item 0 hashivault anyOf item 0 token
Type: string or null

Vault token as plain string

Use for testing only. DO NOT COMMIT NOVOPS CONFIG WITH THIS SET.

root config anyOf item 0 hashivault anyOf item 0 token_path
Type: string or null

Vault token path.

Example: /var/secrets/vault-token

root config anyOf item 0 hashivault anyOf item 0 verify
Type: boolean or null

Whether to enable TLS verify (true by default)
root config anyOf item 0 hashivault anyOf item 1
Type: null
root config anyOf item 1
Type: null

root environments
Type: object

Source of truth defining files and variables loaded by Novops

Environments are named uniquely (such as "dev", "prod"...) to allow for different configs to be loaded in various contexts

Each additional property must conform to the following schema

root environments NovopsEnvironmentInput
Type: object

Modules to be loaded for an environment. Each module defines one or more Input which will be resolved into Outputs (files & variables)

root environments additionalProperties aws

Assume an AWS Role from local config.

Outputs environment variables AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN with temporary credentials for IAM Role.

root environments additionalProperties aws anyOf AwsInput
Type: object

root environments additionalProperties aws anyOf item 0 assume_role
Type: object

Assume an IAM Role

root environments additionalProperties aws anyOf item 0 assume_role duration_seconds
Type: integer or nullFormat: int32

Duration of the role session (seconds). Can range from 900 seconds up to the maximum session duration set for the role. Default to 1h (3600).

root environments additionalProperties aws anyOf item 0 assume_role source_profile
Type: string or null

Source profile. Must exist in config.
root environments additionalProperties aws anyOf item 1
Type: null

root environments additionalProperties files
Type: array or null

Files resolving to concrete files on local filesystem and environment variables pointing to file

 No Additional Items

Each item of this array must be:

root environments additionalProperties files FileInput
Type: object

root environments additionalProperties files files items content
Type: object

File content

root environments additionalProperties files files items content anyOf AwsSecretsManagerSecretInput
Type: object

Reference an AWS Secret Manager secret

root environments additionalProperties files files items content anyOf item 0 aws_secret
Type: object

Structure to request a Secrets Manager secret

Maps directly to GetSecretValue API. See https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html

root environments additionalProperties files files items content anyOf item 0 aws_secret id
Type: string

Secret ID

root environments additionalProperties files files items content anyOf item 0 aws_secret version_id
Type: string or null

The unique identifier of the version of the secret to retrieve.

root environments additionalProperties files files items content anyOf item 0 aws_secret version_stage
Type: string or null

The staging label of the version of the secret to retrieve.
root environments additionalProperties files files items content anyOf GCloudSecretManagerSecretInput
Type: object

Reference Secret Manager secret

root environments additionalProperties files files items content anyOf item 1 gcloud_secret
Type: object

Structure to request a GCloud Secret Manager secret

See https://cloud.google.com/secret-manager/docs/reference/rest/v1/projects.secrets/get

root environments additionalProperties files files items content anyOf item 1 gcloud_secret name
Type: string

Name of the secret in the format projects/*\/secrets/*\/versions/* Such as projects/my-org-project/secrets/my-secret/latest Or projects/my-org-project/secrets/my-secret/42 for a specific version

root environments additionalProperties files files items content anyOf item 1 gcloud_secret validate_crc32c
Type: boolean or null

Whether to validate crc32c checksum provided with secret (default: true)
root environments additionalProperties files files items content anyOf StringResolvableInput
Type: object

All possible inputs resolving to a string value

root environments additionalProperties files files items content anyOf item 2 anyOf item 0
Type: string
root environments additionalProperties files files items content anyOf item 2 anyOf BitwardenItemInput
Type: object

A BitWarden secret reference

root environments additionalProperties files files items content anyOf item 2 anyOf item 1 bitwarden
Type: object

A BitWarden entry

root environments additionalProperties files files items content anyOf item 2 anyOf item 1 bitwarden entry
Type: string

Entry name

root environments additionalProperties files files items content anyOf item 2 anyOf item 1 bitwarden field
Type: string

Field in entry to use as value.
root environments additionalProperties files files items content anyOf item 2 anyOf HashiVaultKeyValueV2Input
Type: object

Reference a Key Value V2 secret

root environments additionalProperties files files items content anyOf item 2 anyOf item 2 hvault_kv2
Type: object

Reference a Key Value V2 secret

root environments additionalProperties files files items content anyOf item 2 anyOf item 2 hvault_kv2 key
Type: string

Secret key to retrieve

root environments additionalProperties files files items content anyOf item 2 anyOf item 2 hvault_kv2 mount
Type: string or null

KV v2 mount point

default to "secret/"

root environments additionalProperties files files items content anyOf item 2 anyOf item 2 hvault_kv2 path
Type: string

Path to secret
root environments additionalProperties files files items content anyOf item 2 anyOf HashiVaultKeyValueV1Input
Type: object

Reference a Key Value V1 secret

root environments additionalProperties files files items content anyOf item 2 anyOf item 3 hvault_kv1
Type: object

Reference a Key Value V1 secret

root environments additionalProperties files files items content anyOf item 2 anyOf item 3 hvault_kv1 key
Type: string

Secret key to retrieve

root environments additionalProperties files files items content anyOf item 2 anyOf item 3 hvault_kv1 mount
Type: string or null

KV v1 mount point

default to "kv/"

root environments additionalProperties files files items content anyOf item 2 anyOf item 3 hvault_kv1 path
Type: string

Path to secret
root environments additionalProperties files files items content anyOf item 2 anyOf AwsSSMParamStoreInput
Type: object

Reference an SSM Parameter config or secret

root environments additionalProperties files files items content anyOf item 2 anyOf item 4 aws_ssm_parameter
Type: object

Reference an SSM Parameter config or secret

Maps directly to GetParameter API. See https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetParameter.html

root environments additionalProperties files files items content anyOf item 2 anyOf item 4 aws_ssm_parameter name
Type: string

Parameter name

root environments additionalProperties files files items content anyOf item 2 anyOf item 4 aws_ssm_parameter with_decryption
Type: boolean or null

Return decrypted values for secure string parameters. This flag is ignored for String and StringList parameter types.
root environments additionalProperties files files items content anyOf item 2 anyOf AwsSecretsManagerSecretInput
Type: object

Reference an AWS Secret Manager secret

root environments additionalProperties files files items content anyOf item 2 anyOf item 5 aws_secret
Type: object

Structure to request a Secrets Manager secret

Maps directly to GetSecretValue API. See https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html

root environments additionalProperties files files items content anyOf item 2 anyOf item 5 aws_secret id
Type: string

Secret ID

root environments additionalProperties files files items content anyOf item 2 anyOf item 5 aws_secret version_id
Type: string or null

The unique identifier of the version of the secret to retrieve.

root environments additionalProperties files files items content anyOf item 2 anyOf item 5 aws_secret version_stage
Type: string or null

The staging label of the version of the secret to retrieve.
root environments additionalProperties files files items content anyOf item 2 anyOf GCloudSecretManagerSecretInput
Type: object

Reference Secret Manager secret

root environments additionalProperties files files items content anyOf item 2 anyOf item 6 gcloud_secret
Type: object

Structure to request a GCloud Secret Manager secret

See https://cloud.google.com/secret-manager/docs/reference/rest/v1/projects.secrets/get

root environments additionalProperties files files items content anyOf item 2 anyOf item 6 gcloud_secret name
Type: string

Name of the secret in the format projects/*\/secrets/*\/versions/* Such as projects/my-org-project/secrets/my-secret/latest Or projects/my-org-project/secrets/my-secret/42 for a specific version

root environments additionalProperties files files items content anyOf item 2 anyOf item 6 gcloud_secret validate_crc32c
Type: boolean or null

Whether to validate crc32c checksum provided with secret (default: true)
root environments additionalProperties files files items content anyOf item 2 anyOf AzureKeyvaultSecretInput
Type: object

Reference an Azure Keyvault secret

root environments additionalProperties files files items content anyOf item 2 anyOf item 7 azure_keyvault_secret
Type: object

Maps directly to Keyvault Get Secret API

See https://learn.microsoft.com/en-us/rest/api/keyvault/secrets/get-secret/get-secret?tabs=HTTP

root environments additionalProperties files files items content anyOf item 2 anyOf item 7 azure_keyvault_secret name
Type: string

Secret name

root environments additionalProperties files files items content anyOf item 2 anyOf item 7 azure_keyvault_secret vault
Type: string

Secret's vault name

root environments additionalProperties files files items content anyOf item 2 anyOf item 7 azure_keyvault_secret version
Type: string or null

Secret's version (default: latest)
root environments additionalProperties files files items content anyOf item 2 anyOf SopsValueInput
Type: object

SOPS input to be used as file, variables or other kind of value input

root environments additionalProperties files files items content anyOf item 2 anyOf item 8 sops
Type: object

root environments additionalProperties files files items content anyOf item 2 anyOf item 8 sops additional_flags
Type: array of string or null

Additional flags passed to sops after --decrypt --extract

 No Additional Items

Each item of this array must be:

root environments additionalProperties files files items content anyOf item 2 anyOf item 8 sops additional_flags additional_flags items
Type: string

root environments additionalProperties files files items content anyOf item 2 anyOf item 8 sops extract
Type: string or null

Extract a specific field via --extract flag

root environments additionalProperties files files items content anyOf item 2 anyOf item 8 sops file
Type: string

Path to encrypted file
root environments additionalProperties files files items content anyOf item 2 anyOf AwsS3ObjectInput
Type: object

Reference an S3 object

root environments additionalProperties files files items content anyOf item 2 anyOf item 9 aws_s3_object
Type: object

Reference an S3 object

root environments additionalProperties files files items content anyOf item 2 anyOf item 9 aws_s3_object bucket
Type: string

S3 bucket name

root environments additionalProperties files files items content anyOf item 2 anyOf item 9 aws_s3_object key
Type: string

S3 object key

root environments additionalProperties files files items content anyOf item 2 anyOf item 9 aws_s3_object region
Type: string or null

Optional bucket region name

root environments additionalProperties files files items dest
Type: string or null

DEPRECATED: dest is insecure as generated file may be written in insecure directory and/or persist on disk. Use symlink instead to create a symbolic link pointing to generated file in secure Novops secure directory.

Destination where file will be generated. Default to secure Novops working directory.

Setting this value may prevent file from being auto-deleted as it won't be managed in a safe location and may remain indefinitely.

root environments additionalProperties files files items name
Type: string or null

File name to use when auto-generating file and variable name. if not set, the YAML key for file will be used

root environments additionalProperties files files items variable
Type: string or null

Environment variable name pointing to generated file.

Example: setting NPM_TOKEN will output an environment variable pointing to file path such as

NPM_TOKEN: /run/user/1000/novops/dev/file_xxx

See also symlink to create a symlink pointing to file in secure Novops working directory;

root environments additionalProperties hashivault

Reference one or more Hashicorp Vault Secret Engines to generate either files or variables.

root environments additionalProperties hashivault anyOf HashiVaultInput
Type: object

root environments additionalProperties hashivault anyOf item 0 aws
Type: object

Use Vault AWS Secret Engine to generate temporary AWS credentials.

root environments additionalProperties hashivault anyOf item 0 aws mount
Type: string or null

Secret Engine mount point. Default to 'aws'.

root environments additionalProperties hashivault anyOf item 0 aws name
Type: string

Vault role name

root environments additionalProperties hashivault anyOf item 0 aws role_arn
Type: string or null

AWS IAM Role ARN

root environments additionalProperties hashivault anyOf item 0 aws ttl
Type: string or null

Generated token time to live. Example: "3600s"
root environments additionalProperties hashivault anyOf item 1
Type: null

root environments additionalProperties sops_dotenv
Type: array or null

Reference SOPS encrypted file(s) as dotenv to load variables

 No Additional Items

Each item of this array must be:

root environments additionalProperties sops_dotenv SopsDotenvInput
Type: object

SOPS input directly under an environment to load file content as environment variables Encrypted SOPS files must be in a valid dotenv format

root environments additionalProperties sops_dotenv sops_dotenv items additional_flags
Type: array of string or null

Additional flags passed to sops

 No Additional Items

Each item of this array must be:

root environments additionalProperties sops_dotenv sops_dotenv items additional_flags additional_flags items
Type: string

root environments additionalProperties sops_dotenv sops_dotenv items extract
Type: string or null

Extract a specific field via --extract flag

root environments additionalProperties sops_dotenv sops_dotenv items file
Type: string

Path to encrypted file

root environments additionalProperties variables
Type: array or null

Variables resolving to environment variables from provided source

 No Additional Items

Each item of this array must be:

root environments additionalProperties variables VariableInput
Type: object

root environments additionalProperties variables variables items name
Type: string

Environment variable name, such as NPM_TOKEN

root environments additionalProperties variables variables items value
Type: object

Source of truth for variable

root environments additionalProperties variables variables items value anyOf item 0
Type: string
root environments additionalProperties variables variables items value anyOf BitwardenItemInput
Type: object

A BitWarden secret reference

root environments additionalProperties variables variables items value anyOf item 1 bitwarden
Type: object

A BitWarden entry

root environments additionalProperties variables variables items value anyOf item 1 bitwarden entry
Type: string

Entry name

root environments additionalProperties variables variables items value anyOf item 1 bitwarden field
Type: string

Field in entry to use as value.
root environments additionalProperties variables variables items value anyOf HashiVaultKeyValueV2Input
Type: object

Reference a Key Value V2 secret

root environments additionalProperties variables variables items value anyOf item 2 hvault_kv2
Type: object

Reference a Key Value V2 secret

root environments additionalProperties variables variables items value anyOf item 2 hvault_kv2 mount
Type: string or null

KV v2 mount point

default to "secret/"
root environments additionalProperties variables variables items value anyOf HashiVaultKeyValueV1Input
Type: object

Reference a Key Value V1 secret

root environments additionalProperties variables variables items value anyOf item 3 hvault_kv1
Type: object

Reference a Key Value V1 secret

root environments additionalProperties variables variables items value anyOf item 3 hvault_kv1 mount
Type: string or null

KV v1 mount point

default to "kv/"
root environments additionalProperties variables variables items value anyOf AwsSSMParamStoreInput
Type: object

Reference an SSM Parameter config or secret

root environments additionalProperties variables variables items value anyOf item 4 aws_ssm_parameter
Type: object

Reference an SSM Parameter config or secret

Maps directly to GetParameter API. See https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetParameter.html

root environments additionalProperties variables variables items value anyOf item 4 aws_ssm_parameter with_decryption
Type: boolean or null

Return decrypted values for secure string parameters. This flag is ignored for String and StringList parameter types.
root environments additionalProperties variables variables items value anyOf AwsSecretsManagerSecretInput
Type: object

Reference an AWS Secret Manager secret

root environments additionalProperties variables variables items value anyOf item 5 aws_secret
Type: object

Structure to request a Secrets Manager secret

Maps directly to GetSecretValue API. See https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html

root environments additionalProperties variables variables items value anyOf item 5 aws_secret version_id
Type: string or null

The unique identifier of the version of the secret to retrieve.

root environments additionalProperties variables variables items value anyOf item 5 aws_secret version_stage
Type: string or null

The staging label of the version of the secret to retrieve.
root environments additionalProperties variables variables items value anyOf GCloudSecretManagerSecretInput
Type: object

Reference Secret Manager secret

root environments additionalProperties variables variables items value anyOf item 6 gcloud_secret
Type: object

Structure to request a GCloud Secret Manager secret

See https://cloud.google.com/secret-manager/docs/reference/rest/v1/projects.secrets/get

root environments additionalProperties variables variables items value anyOf item 6 gcloud_secret name
Type: string

Name of the secret in the format projects/*\/secrets/*\/versions/* Such as projects/my-org-project/secrets/my-secret/latest Or projects/my-org-project/secrets/my-secret/42 for a specific version

root environments additionalProperties variables variables items value anyOf item 6 gcloud_secret validate_crc32c
Type: boolean or null

Whether to validate crc32c checksum provided with secret (default: true)
root environments additionalProperties variables variables items value anyOf AzureKeyvaultSecretInput
Type: object

Reference an Azure Keyvault secret

root environments additionalProperties variables variables items value anyOf item 7 azure_keyvault_secret
Type: object

Maps directly to Keyvault Get Secret API

See https://learn.microsoft.com/en-us/rest/api/keyvault/secrets/get-secret/get-secret?tabs=HTTP

root environments additionalProperties variables variables items value anyOf item 7 azure_keyvault_secret version
Type: string or null

Secret's version (default: latest)
root environments additionalProperties variables variables items value anyOf SopsValueInput
Type: object

SOPS input to be used as file, variables or other kind of value input

root environments additionalProperties variables variables items value anyOf item 8 sops
Type: object

root environments additionalProperties variables variables items value anyOf item 8 sops additional_flags
Type: array of string or null

Additional flags passed to sops after --decrypt --extract

 No Additional Items

Each item of this array must be:

root environments additionalProperties variables variables items value anyOf item 8 sops additional_flags additional_flags items
Type: string

root environments additionalProperties variables variables items value anyOf item 8 sops extract
Type: string or null

Extract a specific field via --extract flag

root environments additionalProperties variables variables items value anyOf AwsS3ObjectInput
Type: object

Reference an S3 object

root name
Type: string or null

Application name. Informational only.

If not specified, use current directory name