Variables and secrets

Variables keep configuration out of your scripts. DurpDeploy passes them to scripts as environment variables.

Add a variable

1. Open your project.
2. Open Variables from the project menu.
3. Enter the name and value.
4. Choose an environment scope or leave it Unscoped.
5. Enable the secret option for sensitive values.
6. Save the variable.

Use names such as APP_URL, DEPLOY_ENV, or API_TOKEN. Start names with a letter or underscore. Use only ASCII letters, digits, and underscores, with a maximum of 255 characters.

Choose the right scope

An unscoped value applies across environments. An environment-scoped value overrides the same name for that environment.

For example, create these two non-secret variables:

• APP_URL = https://test.example.com, scoped to test.
• APP_URL = https://app.example.com, scoped to production.

The same script receives the appropriate URL for its deployment environment. Projects with a lifecycle can use only that lifecycle’s stage environments. Administrators can also manage shared lifecycle variables.

Read variables in scripts

Use the syntax for your selected interpreter:

# Bash
printf 'Application: %s\n' "$APP_URL"

# PowerShell
Write-Output "Application: $env:APP_URL"

# Python
import os
print(f"Application: {os.environ['APP_URL']}")

These examples print a non-secret URL. Avoid printing passwords or tokens.

Limit what each step receives

By default, a step receives all resolved release variables. Enter names in Limit variables (optional) to give that step only those variables. For example, enter APP_URL, API_TOKEN.

Container steps reject reserved runtime names, including PATH, HOME, and XDG_* names. DurpDeploy also reserves ARTIFACT_PATH, DURPDEPLOY_STAGE_DIR, and DURPDEPLOY_APPROVED_DIR for its own use.

Protect secrets

Secret variables are encrypted in storage and masked in deployment logs. Masking does not make an untrusted script safe. A script that receives a secret can use it or send it elsewhere. Give secrets only to trusted scripts and the steps that need them.

Keep the server encryption key in your backup plan. Without the matching key, a restored database cannot recover encrypted values.

Apply changed values

A release saves variables when you create it. After editing project variables, create a new release or select Refresh on the existing release. Future deployments use the updated release values. Existing deployment snapshots stay unchanged.