Змінні середовища застосунків

OpenFactory can store app-scoped and account-scoped environment values, encrypt at rest, render into candidate app VM during deploy. Early file-backed secret store, not managed vault.

Scope and precedence

Account values reusable defaults for every app owned by account.
App values override account values with same name.
Managed values written by configured producer token and record producer that owns key.
Changed value increments env_version; successful deploy records applied version. Difference means redeploy required.

Names must be uppercase environment identifiers, limited to 128 characters, cannot use reserved OPENFACTORY_ prefix. User values limited to 8 KiB and app limited to 100 keys.

MCP workflow

List operations always mask values. Reveal one value only when necessary:


set_app_env(
  app_id="550e8400-e29b-41d4-a716-446655440000",
  set={"API_BASE_URL": "https://api.example.internal"}
)

list_app_env(app_id="550e8400-e29b-41d4-a716-446655440000")

reveal_app_env(
  app_id="550e8400-e29b-41d4-a716-446655440000",
  name="API_BASE_URL"
)

Same pattern available as set_account_env, list_account_env, reveal_account_env. App-level set/delete operations return env_version and redeploy_hint; setting value does not mutate running VM.

REST surface

Method	Path	Purpose
`GET`	`/api/apps/{app_id}/env`	Masked app-key list and version state
`PUT`	`/api/apps/{app_id}/env`	Transactional set/delete for app keys
`POST`	`/api/apps/{app_id}/env/reveal`	Audited plaintext reveal of one app key
`GET`	`/api/account/env`	Masked account-key list
`PUT`	`/api/account/env`	Transactional set/delete for account keys
`POST`	`/api/account/env/reveal`	Audited plaintext reveal of one account key
`PUT`	`/api/apps/{app_id}/env/managed`	Configured producer publishes managed keys
`DELETE`	`/api/apps/{app_id}/env/managed/{name}`	Producer removes managed key it owns

User surfaces enforce resolved owner context. Managed endpoints use <kid>.<secret> bearer credential from operator-configured producer-token file; without that file producer API returns unavailable.

Deploy behavior

During deploy backend decrypts account values, overlays app values, adds platform runtime fields, writes /etc/openfactory/app.env in VM with mode 0600. Process started with that file as environment. If decryption, file delivery, startup fails, candidate not promoted.

Security boundary

Stored values use Fernet encryption. Operator must supply and protect OPENFACTORY_ENV_MASTER_KEY; losing or replacing makes existing values undecryptable.
List responses masked. Explicit reveals and mutations append JSONL audit event.
Current storage and audit trail local files. Do not provide hardware-backed keys, multi-party approval, tamper-evident logging, automatic rotation, disaster-recovery guarantee.
Application and deploy logs do not yet provide complete secret-redaction boundary. Process printing environment, credential-bearing URL, secret in error can expose in logs and test evidence.

Do not use preview store for production credentials until deployment has independent access controls, backup restore tests, log-redaction validation, retention rules, documented key-rotation procedure. Never place secrets in recipes, source code, commands, URLs, test descriptions, assertion expectations.

See App deployment for candidate promotion flow.