Values and secrets

A script describes what should exist; it does not hold the settings that differ between environments, and it never holds a secret. Both live in the environment, and the file refers to them by name. That is what lets one file deploy to dev and prod, and lets you commit it without leaking anything.

var.NAME

var.NAME stands for a setting stored in the environment being deployed — an image tag, a log level, a third-party endpoint. Set values on the Values screen of each environment. When Ackee plans a deploy it substitutes each reference with that environment's value, exactly as if it had been typed into the file.

ackee 1
​
project "shop" {
  cloud  = "aws"
  region = "us-east-1"
}
​
service "web" {
  image = var.IMAGE_TAG_WEB
  port  = 80
​
  env = {
    SENTRY_DSN = var.SENTRY_DSN
  }
}

• A reference may stand anywhere a value is passed straight through to a resource: a node's string fields, a service's image, and the values of a service's env map.
• It may not stand for a field that decides what gets built, such as size or engine: references are resolved after the file is expanded, too late to choose (AK301).
• A reference with no value in the environment stops the deploy before anything is built, naming every missing value at once (AK304).

Secrets

A secret's value must never pass through the file, the plan, or Ackee's records of what it built. So a secret is a resource in your cloud's own secret manager, declared with secret and connected to whatever reads it. The connection hands the reader a reference that the platform resolves when the container starts:

ackee 1
​
project "shop" {
  cloud  = "aws"
  region = "us-east-1"
}
​
service "web" {
  image = "public.ecr.aws/nginx/nginx:latest"
  port  = 80
}
​
# The secret holds no value in the file. Set it in your cloud's
# secret manager; the service reads it when it starts.
secret "stripe" {
  description = "Stripe API key"
}
​
connect env "web" -> "stripe"

The file creates the secret empty. Put its value in the secret manager — AWS Secrets Manager, Google Secret Manager or Azure Key Vault — under the name the plan shows. Replacing the value there replaces it everywhere, with no change to the file.

secret.NAME

secret.NAME is the reference form for secrets stored in the environment, alongside var.NAME. The language reads it, but it cannot be deployed yet (AK305): resolving one needs the secret created in your cloud outside the deployment, which Ackee does not do yet. Use a secret resource as above until it does.