By johnbrunton
I’m using App Platform and I would like to commit my log forwarding configuration to source control. I’m using Logtail, so the configuration looks something like this:
services:
- name: MyService
log_destinations:
- logtail:
token: my-logtail-token
name: MyAppLogs
I would prefer to encrypt the Logtail token before committing it to source control, however, since I believe it’s basically an API auth token. I tried adding it as an application secret, like below, but I believe these secrets are only available at build and runtime, and cannot be injected into the configuration itself?
envs:
- key: LOGTAIL_TOKEN
scope: RUN_AND_BUILD_TIME
type: SECRET
value: EV[...]
...
services:
- name: MyService
log_destinations:
- logtail:
token: ${LOGTAIL_TOKEN}
name: MyAppLogs
Certainly, this didn’t seem to work.
Is there a way to accomplish what I’m trying to do? Thanks in advance.
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
Hi there,
That’s a great question. From what I’ve gathered, the Logtail token should indeed be treated as a secret. While it’s currently displayed in clear text within the App Spec, it’s important to avoid sharing this token publicly, such as in a public repository. Exposing this token could potentially allow unauthorized access to your log data.
I’ve reached out to the team at DigitalOcean and shared your feedback.
However, for the time being, it’s best to keep that token private and avoid including it in any publicly shared files.
If you need to share your App Spec in a public project, I would recommend using a placeholder for the token and providing the actual token through a more secure channel, such as a private environment variable or a secrets management tool.
It looks like someone has had the same idea before and has posted it on the DigitalOcean Product Ideas board. The best thing to do would be to head over and add your vote to it, as well as adding any additional information in the comments for exactly what you’d like to see implemented!
https://ideas.digitalocean.com/app-platform/p/encrypted-log-forwarding-api-keys
I also just upvoted that idea as well.
Let me know if you have any other questions.
- Bobby
Become a contributor for community
Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.
DigitalOcean Documentation
Full documentation for every DigitalOcean product.
Resources for startups and AI-native businesses
The Wave has everything you need to know about building a business, from raising funding to marketing your product.
The developer cloud
Scale up as you grow — whether you're running one virtual machine or ten thousand.
Start building today
From GPU-powered inference and Kubernetes to managed databases and storage, get everything you need to build, scale, and deploy intelligent applications.
