Vault · not set up
Projects' environment variables are encrypted before they are stored, under a key the
auth password unlocks. After a restart the vault is locked until someone logs in.Set
auth on the settings page first: that password is what unlocks the vault.Global variables · in the environment of every build
Locked or not set up: global variables can be listed by name but not read or changed. While any exist and the vault is locked, every build waits.
Unattended servers
For a server nobody logs in to after a reboot, put the recovery key in HONEST_VAULT_KEY_FILE (a file only that user can read) or HONEST_VAULT_KEY, in the .env beside honest.conf or the service's environment. Whoever can read both the database and that key can read every variable.