Skip to content

Commit 4fbfa26

Browse files
mythzmythz
committed
Update docs to use APPSETTINGS_JSON secret
1 parent 76efa1c commit 4fbfa26

File tree

2 files changed

+108
-74
lines changed

2 files changed

+108
-74
lines changed

‎content/docs/configuration.mdx‎

Lines changed: 56 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -45,30 +45,40 @@ services.AddSingleton<IEmailSender<ApplicationUser>, EmailSender>();
4545

4646
### App Settings Secrets
4747

48-
Instead of polluting each GitHub Repository with multiple App-specific GitHub Action Secrets, you can save all your secrets in a single `APPSETTINGS_PATCH` GitHub Action Secret to patch `appsettings.json` with environment-specific configuration using [JSON Patch](https://jsonpatch.com). E.g:
48+
Instead of polluting each GitHub Repository with multiple App-specific GitHub Action Secrets, you can save all your secrets in a single `APPSETTINGS_JSON` GitHub Action Secret which will get written inside the Docker container `appsettings.Production.json`, e.g:
4949

5050
```json
51-
[
52-
{
53-
"op":"replace",
54-
"path":"/ConnectionStrings/DefaultConnection",
55-
"value":"Server=service-postgres;Port=5432;User Id=dbuser;Password=dbpass;Database=dbname;Pooling=true;"
56-
},
57-
{ "op":"add", "path":"/SmtpConfig", "value":{
58-
"UserName": "SmtpUser",
59-
"Password": "SmtpPass",
60-
"Host": "email-smtp.us-east-1.amazonaws.com",
61-
"Port": 587,
62-
"From": "[email protected]",
63-
"FromName": "MyApp",
64-
"Bcc": "[email protected]"
65-
}
66-
},
67-
{ "op":"add", "path":"/Admins", "value": ["[email protected]","[email protected]"] },
68-
{ "op":"add", "path":"/CorsFeature/allowOriginWhitelist/-", "value":"https://servicestack.net" }
69-
]
51+
{
52+
"ConnectionStrings": {
53+
"DefaultConnection": "Server=service-postgres;Port=5432;User Id=dbuser;Password=dbpass;Database=dbname;Pooling=true;"
54+
},
55+
"SmtpConfig": {
56+
"UserName": "SmtpUser",
57+
"Password": "SmtpPass",
58+
"Host": "email-smtp.us-east-1.amazonaws.com",
59+
"Port": 587,
60+
"From": "[email protected]",
61+
"FromName": "MyApp",
62+
"Bcc": "[email protected]"
63+
}
64+
},
65+
"Admins": ["[email protected]","[email protected]"]
66+
}
67+
```
68+
69+
After changing `appsettings.Production.json` update your `APPSETTINGS_JSON` GitHub Action Secret with:
70+
71+
```bash
72+
npm run secret:prod
73+
```
74+
75+
This uses the GitHub CLI to add your `appsettings.Production.json` to your GitHub repository's Action secrets:
76+
77+
```bash
78+
gh secret set APPSETTINGS_JSON < appsettings.Production.json
7079
```
7180

81+
7282
### SMTP Email
7383

7484
Enable email sending by uncommenting in `Program.cs`:
@@ -95,38 +105,37 @@ npx add-in db-identity
95105

96106
### App Settings Secrets
97107

98-
You could register any App-specific secrets here, although our preference is instead of polluting each
99-
GitHub Repository with multiple App-specific GitHub Action Secrets, you can save all your secrets in a single
100-
`APPSETTINGS_PATCH` GitHub Action Secret to patch `appsettings.json` with environment-specific configuration
101-
using [JSON Patch](https://jsonpatch.com). E.g:
108+
You could register any App-specific secrets here, although our preference is to instead save all your secrets in a single `APPSETTINGS_JSON` GitHub Action Secret which will get written inside the Docker container `appsettings.Production.json`, e.g:
109+
110+
```json
111+
{
112+
"ConnectionStrings": {
113+
"DefaultConnection": "Server=service-postgres;Port=5432;User Id=dbuser;Password=dbpass;Database=dbname;Pooling=true;"
114+
},
115+
"SmtpConfig": {
116+
"UserName": "SmtpUser",
117+
"Password": "SmtpPass",
118+
"Host": "email-smtp.us-east-1.amazonaws.com",
119+
"Port": 587,
120+
"From": "[email protected]",
121+
"FromName": "MyApp",
122+
"Bcc": "[email protected]"
123+
}
124+
},
125+
"Admins": ["[email protected]","[email protected]"]
126+
}
127+
```
128+
129+
After changing `appsettings.Production.json` update your `APPSETTINGS_JSON` GitHub Action Secret with:
102130

103131
```bash
104-
# JSON Patch to apply to appsettings.json:
105-
gh secret set APPSETTINGS_PATCH [json-patch]
132+
npm run secret:prod
106133
```
107134

108-
JSON Patch example:
135+
This uses the GitHub CLI to add your `appsettings.Production.json` to your GitHub repository's Action secrets:
109136

110-
```json
111-
[
112-
{
113-
"op":"replace",
114-
"path":"/ConnectionStrings/DefaultConnection",
115-
"value":"Server=service-postgres;Port=5432;User Id=dbuser;Password=dbpass;Database=dbname"
116-
},
117-
{ "op":"add", "path":"/SmtpConfig", "value":{
118-
"UserName": "SmtpUser",
119-
"Password": "SmtpPass",
120-
"Host": "email-smtp.us-east-1.amazonaws.com",
121-
"Port": 587,
122-
"From": "[email protected]",
123-
"FromName": "MyApp",
124-
"Bcc": "[email protected]"
125-
}
126-
},
127-
{ "op":"add", "path":"/Admins", "value": ["[email protected]","[email protected]"] },
128-
{ "op":"add", "path":"/CorsFeature/allowOriginWhitelist/-", "value":"https://servicestack.net" }
129-
]
137+
```bash
138+
gh secret set APPSETTINGS_JSON < appsettings.Production.json
130139
```
131140

132141
### Kamal Accessories

‎content/docs/deployments.mdx‎

Lines changed: 52 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -57,40 +57,65 @@ The only secret that needs to be configured per App is:
5757
gh secret set KAMAL_DEPLOY_HOST <www.example.org>
5858
```
5959

60-
You could register any App-specific secrets here, although our preference is instead of polluting each
61-
GitHub Repository with multiple App-specific GitHub Action Secrets, you can save all your secrets in a single
62-
`APPSETTINGS_PATCH` GitHub Action Secret to patch `appsettings.json` with environment-specific configuration
63-
using [JSON Patch](https://jsonpatch.com). E.g:
60+
### App Settings Secrets
61+
62+
You could register any App-specific secrets here, although our preference is to instead save all your secrets in a single `APPSETTINGS_JSON` GitHub Action Secret which will get written inside the Docker container `appsettings.Production.json`, e.g:
63+
64+
```json
65+
{
66+
"ConnectionStrings": {
67+
"DefaultConnection": "Server=service-postgres;Port=5432;User Id=dbuser;Password=dbpass;Database=dbname;Pooling=true;"
68+
},
69+
"SmtpConfig": {
70+
"UserName": "SmtpUser",
71+
"Password": "SmtpPass",
72+
"Host": "email-smtp.us-east-1.amazonaws.com",
73+
"Port": 587,
74+
"From": "[email protected]",
75+
"FromName": "MyApp",
76+
"Bcc": "[email protected]"
77+
}
78+
},
79+
"Admins": ["[email protected]","[email protected]"]
80+
}
81+
```
82+
83+
After changing `appsettings.Production.json` update your `APPSETTINGS_JSON` GitHub Action Secret with:
6484

6585
```bash
66-
# JSON Patch to apply to appsettings.json:
67-
gh secret set APPSETTINGS_PATCH [json-patch]
86+
npm run secret:prod
6887
```
6988

70-
JSON Patch example:
89+
This uses the GitHub CLI to add your `appsettings.Production.json` to your GitHub repository's Action secrets:
7190

72-
```json
73-
[
74-
{
75-
"op":"replace",
76-
"path":"/ConnectionStrings/DefaultConnection",
77-
"value":"Server=service-postgres;Port=5432;User Id=dbuser;Password=dbpass;Database=dbname"
78-
},
79-
{ "op":"add", "path":"/SmtpConfig", "value":{
80-
"UserName": "SmtpUser",
81-
"Password": "SmtpPass",
82-
"Host": "email-smtp.us-east-1.amazonaws.com",
83-
"Port": 587,
84-
"From": "[email protected]",
85-
"FromName": "MyApp",
86-
"Bcc": "[email protected]"
87-
}
88-
},
89-
{ "op":"add", "path":"/Admins", "value": ["[email protected]","[email protected]"] },
90-
{ "op":"add", "path":"/CorsFeature/allowOriginWhitelist/-", "value":"https://servicestack.net" }
91-
]
91+
```bash
92+
gh secret set APPSETTINGS_JSON < appsettings.Production.json
9293
```
9394

95+
**How It Works:**
96+
97+
1. **Development** - Create `appsettings.Production.json` locally with your production configuration
98+
2. **Upload** - Run `npm run secret:prod` to store it as a GitHub Action secret (never committed to git)
99+
3. **Deployment** - GitHub Actions injects the secret as the `APPSETTINGS_JSON_BASE64` environment variable
100+
4. **Runtime** - The container startup script decodes and writes it to `/app/dotnet/appsettings.Production.json`
101+
5. **Isolation** - The file is written with root-only permissions, preventing Node.js access
102+
103+
Configuration in [config/deploy.yml](https://github.com/NetCoreTemplates/next-rsc/blob/main/config/deploy.yml):
104+
105+
```yaml
106+
# config/deploy.yml
107+
env:
108+
secret:
109+
- APPSETTINGS_JSON_BASE64 # Base64-encoded production config
110+
```
111+
112+
**Benefits:**
113+
- Secrets never committed to git repository
114+
- Secrets never baked into Docker image layers
115+
- Same Docker image can be used across all environments
116+
- Production configuration remains isolated from Node.js process
117+
118+
94119
### Inferred Variables
95120
96121
These variables are inferred from the GitHub Action context and don't need to be configured.

0 commit comments

Comments
 (0)