Configuration

skret uses a .skret.yaml file in your project root to define environments, providers, and settings.

Schema

version: "1" # Required. Config schema version.
project: myapp # Optional. Project name.
default_env: prod # Optional. Default environment.

environments: # Required. At least one environment.
  prod:
    provider: aws # Required. "aws", "azure", "local", "gcp", or "oci".
    path: /myapp/prod # Required for aws. SSM path prefix.
    region: us-east-1 # Optional for aws/oci. Provider region.
    profile: production # Optional for aws/oci. Credential profile name.
    kms_key_id: arn:... # Optional for aws. Custom KMS key.
    compartment_id: ocid1.compartment.oc1..xxx # Required for oci. Compartment OCID.
    vault_id: ocid1.vault.oc1..yyy # Required for oci. Vault OCID.
    key_id: ocid1.key.oc1..zzz # Optional for oci. Master key for new secrets.

  gcp:
    provider: gcp
    project: my-gcp-project # Required for gcp. GCP project id.
    region: us-east1 # Optional for gcp. GCP location (omit for global).

  dev:
    provider: local # Required. "local" for YAML file.
    file: ./.secrets.dev.yaml # Required for local. Path to secrets file.

required: # Optional. Secrets that must exist.
  - DATABASE_URL
  - API_KEY

exclude: # Optional. Secrets to exclude from injection.
  - DEBUG_TOKEN

Discovery

skret walks from the current directory upward to find .skret.yaml, stopping at the git root (.git directory) or filesystem root.

--config: bypass discovery

Every command accepts a global --config <path> flag that loads the given .skret.yaml directly instead of discovering one from the current directory upward:

skret list --config /etc/skret/app.skret.yaml -e prod
skret env --config /etc/skret/app.skret.yaml -e prod

If the file does not exist, the command fails with a config error; discovery is never used as a fallback.

The production sync image does not load .skret.yaml files or provider credentials. It serves metadata-only plans. Provider projection is authorized separately by the private executor using a signed target manifest. The closed schema is deploy/sync-target-manifest.schema.json; the deploy/sync/candidate.skret.yaml.tmpl fixture is synthetic, value-free, and is not a production configuration.

Precedence

Configuration values are resolved in this order (highest wins):

1. CLI flags — --env, --provider, --path, --region, --profile, --file
2. Environment variables — SKRET_ENV, SKRET_PROVIDER, SKRET_PATH, SKRET_REGION, SKRET_PROFILE
3. Config file — .skret.yaml values
4. Defaults — Built-in defaults

Environment Variables

Variable	Description
SKRET_ENV	Override target environment
SKRET_PROVIDER	Override provider
SKRET_PATH	Override secret path prefix
SKRET_REGION	Override AWS region
SKRET_PROFILE	Override AWS profile
SKRET_LOG	Log level (debug, info, warn, error)
SKRET_LOG_FORMAT	Log format (text, json)

Local Secrets File

For the local provider, secrets are stored in a YAML file:

version: "1"
secrets:
  DATABASE_URL: "postgres://dev:dev@localhost/mydb"
  API_KEY: "dev-key-123"
  REDIS_URL: "redis://localhost:6379"

IMPORTANT: Add .secrets.*.yaml to your .gitignore. The skret init command does this automatically.