External secrets

Towbar supports Infisical and Doppler as external secret providers. Provider credentials live only in the control-plane environment. Workload manifests contain references, and Towbar resolves values during deployment without placing them in Git or returning them to the dashboard.

Infisical

TOWBAR_INFISICAL_ENABLED=true
TOWBAR_INFISICAL_BASE_URL=https://app.infisical.com
TOWBAR_INFISICAL_ALLOW_PRIVATE_NETWORK=false
TOWBAR_INFISICAL_CLIENT_ID=<machine-identity-client-id>
TOWBAR_INFISICAL_CLIENT_SECRET=<machine-identity-client-secret>

Use a machine identity restricted to the projects, environments, paths, and secret versions that Towbar workloads reference. Enable private-network access only for an intentionally self-hosted Infisical endpoint.

Doppler

TOWBAR_DOPPLER_ENABLED=true
TOWBAR_DOPPLER_TOKEN=<service-token>

Use a service token scoped to the required project and configuration. Towbar does not accept a personal dashboard token as a substitute for deliberate machine access.

Reference a value

The map key becomes the application environment variable. The reference names the provider integration, provider-specific secret path or name, optional field and version, and whether the value is required at build or runtime:

.towbar/apps/api.app.yml

externalSecrets:
  STRIPE_SECRET_KEY:
    integration: infisical
    secret: /production/stripe
    field: secret_key
    use: runtime

Resources and Compose projects accept runtime references. Dockerfile and static Apps can also use build references through their secret-safe build path. Other builders reject build secrets rather than risking them in image layers or caches. Validate and restart Towbar after changing a provider. Deploy a non-production workload that references a test secret before rotating production credentials. See Shared and workload secrets and the deployment manifest.

Overview

Source control

Container registries

Backup providers