Running your application
Environment variables
How the variables of an environment are kept in your own Secret Manager, and how to read and change them.
On this page
The environment variables of an environment are kept in the Secret Manager of your own Scaleway project. Brewless keeps their names and their revisions, never a value. When you ask to see or change the values, Brewless reads or writes them in your Secret Manager with the connection it already has and passes them on. They are not stored and not logged, and that someone looked at them is written to the audit trail.
From the command line
Fetch the variables of an environment into a file:
brewless env:pull production
This writes .env.production, with a first line that notes the revision you pulled. Change it and push it back:
brewless env:push production
Both commands go through Brewless, so your machine needs no Scaleway key.
| Option | What it does |
|---|---|
--file= |
Another file than .env.<environment> |
--force |
On env:push: push without asking, also over a revision you did not pull |
--direct |
Read or write the variables in your Secret Manager straight from your machine, with a Scaleway key of your own. The values do not pass through Brewless |
Note
env:pushreplaces the variables of the environment with the contents of the file, comments included. If someone else saved after your last pull, the push is refused before it overwrites their revision. Variables the push would remove are named, and the client asks before it removes them.
With --direct the client takes the key from SCW_SECRET_KEY, or from the active profile of Scaleway's own client (scw init). The key needs to read and write Secret Manager in your project.
From the console
Under Variables on the page of an environment you see the names, and you can set or remove a single variable.
Show values reads every variable from your Secret Manager as one dotenv file, which you can edit and save as a new revision. Saving replaces all variables with the file. When someone saved in between, saving is refused; load the newest revision and make your change again.
A value you set or save there passes through Brewless on its way to your Secret Manager. It is not stored and not logged. To keep values away from Brewless altogether, use brewless env:push --direct.
From brewless.yml
Plain values, such as a locale or a log level, can live in your brewless.yml under variables. A deploy writes them into a new revision before the build, next to the variables that are there. A name that looks like a secret is refused in the file: secrets stay with env:push. See brewless.yml.
A variable the file gives is marked Set in brewless.yml in the console. Changing or removing it here, or with a file that changes it, is refused: the next deploy would put the file's value back. Change it in the file and deploy.
When a change takes effect
Variables reach the containers with the next deploy. Until then the console shows that the newest revision is not live yet.
Names
A name starts with a letter or an underscore and holds only letters, digits and underscores. A value has at most 16,000 characters.