Secret Managers

For production deployments, a cloud secret manager is recommended for storing sensitive values such as passwords, keys, and tokens. If a secret manager is not configured (SECRET_MANAGER=false), the deployment script reads sensitive values directly from the .env file instead.

The supported providers are AWS Secrets Manager, Google Secret Manager, Azure Key Vault, and HashiCorp Vault.

Secret Naming Convention

Provider	Naming	Example
AWS	<prefix>/KEY	kmi/MONGO_PASSWORD
GCP / Azure / Vault	<prefix>-KEY	kmi-MONGO_PASSWORD

The prefix is set via SECRET_PREFIX (default kmi).

Required Secrets

Create the following secrets in your chosen provider:

Secret Key	Description
MONGO_USERNAME	MongoDB root username
MONGO_PASSWORD	MongoDB root password
ADMIN_PASSWORD	KMI admin user password
JWT_SECRET	JWT signing secret (16 bytes hex)
AES_KEY	AES encryption key (32 bytes hex)
OIDC_CLIENT_SECRET	OIDC client secret (only if OIDC_ENABLED=true)

Note

When a secret manager is configured, it takes priority over any sensitive values set in the .env file.

Provider Configuration

AWS Secrets Manager

Configuration in .env:

SECRET_MANAGER=aws
SECRET_PREFIX=kmi
SECRET_REGION=us-west-2

Create the required secrets:

aws secretsmanager create-secret --name kmi/MONGO_USERNAME --secret-string "your_username"
aws secretsmanager create-secret --name kmi/MONGO_PASSWORD --secret-string "your_password"
aws secretsmanager create-secret --name kmi/ADMIN_PASSWORD --secret-string "your_admin_password"
aws secretsmanager create-secret --name kmi/JWT_SECRET --secret-string "your_jwt_secret"
aws secretsmanager create-secret --name kmi/AES_KEY --secret-string "your_aes_key"

# If OIDC enabled:
aws secretsmanager create-secret --name kmi/OIDC_CLIENT_SECRET --secret-string "your_oidc_client_secret"

Google Secret Manager

Configuration in .env:

SECRET_MANAGER=gcp
SECRET_PREFIX=kmi
# SECRET_REGION can be used as the project ID if needed

Create the required secrets:

gcloud secrets create kmi-MONGO_USERNAME --replication-policy="automatic"
gcloud secrets versions add kmi-MONGO_USERNAME --data-file="username.txt"

gcloud secrets create kmi-MONGO_PASSWORD --replication-policy="automatic"
gcloud secrets versions add kmi-MONGO_PASSWORD --data-file="password.txt"

# Repeat for ADMIN_PASSWORD, JWT_SECRET, AES_KEY...

# If OIDC enabled:
gcloud secrets create kmi-OIDC_CLIENT_SECRET --replication-policy="automatic"
echo -n "your_oidc_client_secret" | gcloud secrets versions add kmi-OIDC_CLIENT_SECRET --data-file=-

Azure Key Vault

Configuration in .env:

SECRET_MANAGER=azure
SECRET_PREFIX=kmi
AZURE_KEY_VAULT_NAME=my-vault

Create the required secrets:

az keyvault secret set --vault-name my-vault --name kmi-MONGO_USERNAME --value "your_username"
az keyvault secret set --vault-name my-vault --name kmi-MONGO_PASSWORD --value "your_password"
# Repeat for ADMIN_PASSWORD, JWT_SECRET, AES_KEY...

# If OIDC enabled:
az keyvault secret set --vault-name my-vault --name kmi-OIDC_CLIENT_SECRET --value "your_oidc_client_secret"

HashiCorp Vault

Configuration in .env:

SECRET_MANAGER=vault
SECRET_PREFIX=kmi
VAULT_ADDR=https://vault.example.com:8200

Create the required secrets:

vault kv put secret/kmi/MONGO_USERNAME value="your_username"
vault kv put secret/kmi/MONGO_PASSWORD value="your_password"
# Repeat for ADMIN_PASSWORD, JWT_SECRET, AES_KEY...

# If OIDC enabled:
vault kv put secret/kmi/OIDC_CLIENT_SECRET value="your_oidc_client_secret"

To generate the JWT_SECRET and AES_KEY values before storing them:

# Generate JWT secret (16 bytes hex)
openssl rand -hex 16

# Generate AES key (32 bytes hex)
openssl rand -hex 32