Skip to content
    OpafraDocs

    Connect a secret store

    Add a named connection to your own HashiCorp Vault, Infisical, AWS Secrets Manager or GCP Secret Manager so plans can reference secrets kept there.

    View as MarkdownOpen in ClaudeOpen in ChatGPT

    A connection lets plans reference secrets in the store your team already runs. You do not need one to use secrets at all: anything you create in Opafra is already stored in Opafra, encrypted with a key unique to your workspace.

    Before you begin#

    You need the Owner or Admin role in the workspace. Operators and viewers can see the list of connections, but cannot add or change one.

    You also need a credential for the store that can read the paths your plans will reference. If servers will keep their SSH credential in this connection, it also needs write access under opafra/servers/.

    1. Open the connections#

    Open Inventory, choose Secrets, then open the store summary at the top of the page, Manage connections. The default store, Opafra, is listed first, then the workspace's connections, then the providers you can add.

    2. Choose the provider and name the connection#

    Select the provider under Add a connection. The name is filled in with the provider type, for example hashivault; change it to something that says which store this is.

    A name is up to 40 lowercase letters, digits or underscores, starting with a letter:

    prod_vault
aws_eu

    opafra, internal_vault, memory and env are reserved. References use the name, so choose one you are happy to see in plans.

    3. Enter the connection details#

    Fill in the provider's fields. For example:

    HashiCorp Vault

    Address      https://vault.example.com
Token        hvs.CAESIJ...
Mount path   secret

    Infisical

    Site URL       https://app.infisical.com
Auth method    Universal auth
Client ID      7f2a...
Client secret  ...
Project ID     b41c...
Environment    prod
Secret path    /

    AWS Secrets Manager

    Region             eu-west-1
Access key ID      AKIA...
Secret access key  ...

    GCP Secret Manager

    Project ID            acme-prod
Service account JSON  {"type":"service_account", ...}

    4. Save#

    Choose Connect. Opafra checks the connection before storing it. A credential that cannot authenticate is rejected here, with the store's own message, and nothing is saved.

    Verify it worked#

    The connection appears in the list with its name, type and last check:

    connections
    prod_vault    HashiCorp Vault    Reachable

    The credential itself is never shown again, to you or anyone else. Test runs the check again at any time.

    Then prove a reference resolves end to end. Add a step that reads one secret to a plan aimed at a non-production host:

    a step that reads one secret
    - name: Check the reference resolves
  targets: [web-01]
  tool: ssh.cmd
  args:
    command: "test -n 'secret://prod_vault/apps/api/key' && echo resolved"

    A dry run shows the command with the reference masked as secret://[redacted], which proves only that it was recognised: a dry run does not read the store. Run the step. resolved in its output is the proof. A reference that cannot be resolved fails the step before anything is sent to the host, and the error says why: no connection with that name in this workspace, or no value at that path.

    Change or remove a connection#

    Edit shows every setting except the credentials. Leave a credential field empty to keep the stored value, or enter a new one to replace it; Opafra checks the connection again before saving.

    Renaming a connection breaks references that use the old name. Disconnect asks for confirmation, then removes the connection: references to it fail closed from then on, and servers that keep their credential in it cannot connect until you move them.

    Next steps#