Secrets

Give a project passwords and keys so that their values are not stored in the panel and never reach the repository.

A secret is an environment variable whose value must not go into the repository: a database password, an API key, a token. After this page the project has its secrets, and their values exist only on your server.

How to set them

Open the project in the panel, the Secrets tab.
In the Add or replace block enter a key and a value; Add row gives the next one. You can paste a whole .env file into the key field or switch to the .env mode.
Click Save secrets. Above the button you see how many keys will be added, changed and removed. The panel sends the set to the agent and the project restarts with the new variables. The image is not rebuilt.

The project Secrets page — Saved keys show only their names; a value can only be replaced with a new one.

Where values are stored

Where	What is there
Panel	Only key names and a fingerprint of the set. No values in the database or the action log
Hub	The value passes through: it sits encrypted in the command queue until it is delivered to the agent
Your server	Values are encrypted with AES-256-GCM using `/etc/nolay/agent.key` in the agent database

A value cannot be viewed again after saving anywhere, not even with nolay-agent status: it prints only names.

Secrets and `[env]`

Non-secret variables can live in nolay.toml:

[env]
NODE_ENV = "production"
LOG_LEVEL = "info"

Secrets and [env] reach the container together. If a key is in both, the secret wins. Keys use capital Latin letters, digits and _.

Service keys `NOLAY_*`

Keys with the NOLAY_ prefix are for the agent itself and never reach the application container:

Key	Purpose
`NOLAY_GIT_TOKEN`	access to a private repository over HTTPS
`NOLAY_GIT_SSH_KEY`	access to a private repository over SSH, as a multiline value
`NOLAY_GIT_SSH_KNOWN_HOSTS`	Git host keys; without it the agent remembers the host key on the first connection and checks against it later
`NOLAY_S3_ENDPOINT`, `NOLAY_S3_BUCKET`, `NOLAY_S3_ACCESS_KEY`, `NOLAY_S3_SECRET_KEY`	storage for backups

Troubleshooting

What you see	Why	What to do
The app does not see a variable	The key starts with `NOLAY_`	Rename the key
Code `no_secrets_key`	The server has no encryption key	Run the install command again
You need a saved value	The panel does not keep it	Take the value from its source (password manager, service console) and set it again if needed

Read what is stored where.

How to set them

Where values are stored

Secrets and [env]

Service keys NOLAY_*

Troubleshooting

Next

Secrets and `[env]`

Service keys `NOLAY_*`