Allow secrets expansion in commands and configurations

[fidalgo]

From what I've seen, Secrets and Environment Variables are not expanded/interpolated in options.

So in a config like this:

servers:
  web:
    hosts:
      - a.b.c.d
    logging:
      driver: loki
      options:
        loki-url: "${GRAFANA_LOKI_URL}"
        loki-batch-size: '400'
        loki-retries: 2
        loki-max-backoff: 800ms
        loki-timeout: 1s
        keep-file: true

The GRAFANA_LOKI_URL will be empty, despite being present in the secrets.
In the Environment Variable section of the docs, we can see that only secret envs are interpolated, but what prevent us from interpolating all the variables as per:
https://github.com/bkeepers/dotenv?tab=readme-ov-file#variable-substitution

Edit: If we decide to increase the surface of variables expansion, this issue is related: #1167

[3v0k4]

I assume the philosophy is to only keep secrets in .kamal/secrets.

Though, I see that the only way to pass a password to loki is via loki-url.

Secrets and Environment Variables are not expanded/interpolated in options.

You are correct on the Secrets, but you can actually interpolate Environment Variables with:

servers:
  web:
    hosts:
      - a.b.c.d
    logging:
      driver: loki
      options:
-       loki-url: "${GRAFANA_LOKI_URL}"
+       loki-url: <%= ENV["GRAFANA_LOKI_URL"] %>
        loki-batch-size: '400'
        loki-retries: 2
        loki-max-backoff: 800ms
        loki-timeout: 1s
        keep-file: true

You need ERB syntax because that's how the file is processed.

[fidalgo]

@3v0k4 Thanks for your reply, but I've tried that before and it does not work.

By running docker inspect .... I have:

 "LogConfig": {
                "Type": "loki",
                "Config": {
                    "keep-file": "true",
                    "loki-batch-size": "400",
                    "loki-max-backoff": "800ms",
                    "loki-retries": "2",
                    "loki-timeout": "1s",
                    "loki-url": ""
                }
            },

so the value is empty, although in the Env section the value is filled correctly:

          "Env": [
                "RAILS_MASTER_KEY=.....",
                "GRAFANA_LOKI_URL=https://__:[email protected]/loki/api/v1/push",
......

Because only "secrets" are interpolated.