Plugin Store · Secret
Env / File
The zero-setup default.
Busbar config never wants a raw secret sitting in a YAML file. The Env / File module is the built-in default for resolving a secret reference to its real value at boot or config-apply time: { env: "OPENAI_API_KEY" } reads an environment variable, { file: "/run/secrets/db-password" } reads a file — the standard shape a secrets-mounting sidecar or Kubernetes Secret volume already produces.
Zero dependencies, in the core binary, no plugin to install. It’s the right default when your secrets already live in the process environment or a mounted file.
When secrets live in a real secrets manager instead, swap in a kind: secret plugin (HashiCorp Vault below) — the reference shape at the call site stays the same; only where the value resolves from changes.
Built into the core: the default secret resolution.