ENVLET_TOKENset with glab
Set up
Three steps. The host keeps one secret and everything else arrives at boot.
- 01
Create a token
Add GitLab CI under Access and create a token for the environment it deploys.
ci/gitlab-ciciIts own token, separate from your login.- token
- envlet_•••••••• shown once
- opens
- one project, one environment
- expires
- always
- 02
Set one secret
Add ENVLET_TOKEN as a masked, protected CI/CD variable for the environment the pipeline deploys.
Set the tokenglab variable set ENVLET_TOKEN --masked --value "$(cat ~/.config/envlet/tokens/ci-staging.token)" - 03
Start through Envlet
Prefix job commands with envlet run. The CLI reads ENVLET_TOKEN from the job environment.
Job scripttest: script: - npx -y @envlet/cli run -- npm test
What the host keeps
One secret in GitLab CI. Rotate everything else in Envlet without touching the host.
GitLab CI / production / environment variables
| ENVLET_TOKEN | envlet_•••••••• | the only secret the host keeps |
| DATABASE_URL | •••••••• | moved to Envlet |
| STRIPE_KEY | •••••••• | moved to Envlet |
| SENTRY_DSN | •••••••• | moved to Envlet |
Questions
Will my app start if Envlet is down?
No. It retries for a few seconds, then fails so you notice. It never starts with half an environment.
Do I still need GitLab CI's own secret store?
Only for ENVLET_TOKEN. Everything else lives in Envlet, so you rotate in one place.