App Environment Variables

OpenFactory kann app-scoped und account-scoped environment values speichern, at rest encrypten und during deploy in candidate app VM rendern. Das ist early file-backed secret store, kein managed vault.

Scope und Precedence

Account values sind reusable defaults für jede app owned by that account.
App values override account values mit same name.
Managed values written by configured producer token und record producer owning key.
Changed value incremented env_version; successful deploy records applied version. Difference bedeutet redeploy required.

Names müssen uppercase environment identifiers sein, limited to 128 characters, und können reserved OPENFACTORY_ prefix nicht nutzen. User values limited to 8 KiB und app limited to 100 keys.

MCP workflow

List operations mask values always. Reveal one value only when necessary:


set_app_env(
  app_id="550e8400-e29b-41d4-a716-446655440000",
  set={"API_BASE_URL": "https://api.example.internal"}
)

list_app_env(app_id="550e8400-e29b-41d4-a716-446655440000")

reveal_app_env(
  app_id="550e8400-e29b-41d4-a716-446655440000",
  name="API_BASE_URL"
)

Same pattern als set_account_env, list_account_env, reveal_account_env. App-level set/delete operations return env_version und redeploy_hint; setting value mutiert running VM nicht.

REST surface

Method	Path	Purpose
`GET`	`/api/apps/{app_id}/env`	Masked app-key list und version state
`PUT`	`/api/apps/{app_id}/env`	Transactional set/delete für app keys
`POST`	`/api/apps/{app_id}/env/reveal`	Audited plaintext reveal of one app key
`GET`	`/api/account/env`	Masked account-key list
`PUT`	`/api/account/env`	Transactional set/delete für account keys
`POST`	`/api/account/env/reveal`	Audited plaintext reveal of one account key
`PUT`	`/api/apps/{app_id}/env/managed`	Configured producer publishes managed keys
`DELETE`	`/api/apps/{app_id}/env/managed/{name}`	Producer removes managed key it owns

User surfaces enforce resolved owner context. Managed endpoints nutzen <kid>.<secret> bearer credential from operator-configured producer-token file; without that file producer API returns unavailable.

Deploy behavior

During deploy decrypts backend account values, overlays app values, adds platform runtime fields, writes /etc/openfactory/app.env in VM with mode 0600. Process started with that file as environment. If decryption, file delivery oder startup fails, candidate not promoted.

Security boundary

Stored values use Fernet encryption. Operator must supply and protect OPENFACTORY_ENV_MASTER_KEY; losing or replacing makes existing values undecryptable.
List responses masked. Explicit reveals und mutations append JSONL audit event.
Current storage und audit trail sind local files. Sie provide nicht hardware-backed keys, multi-party approval, tamper-evident logging, automatic rotation oder disaster-recovery guarantee.
Application und deploy logs provide noch nicht complete secret-redaction boundary. Process printing environment, credential-bearing URL oder secret in error kann es in logs und test evidence exposen.

Daher nicht this preview store für production credentials nutzen until deployment independent access controls, backup restore tests, log-redaction validation, retention rules und documented key-rotation procedure hat. Never secrets in recipes, source code, commands, URLs, test descriptions oder assertion expectations.

Siehe App deployment für candidate promotion flow.