# wrkflw Secrets Configuration
# This file demonstrates various secret provider configurations

# Default provider to use when no provider is specified in ${{ secrets.name }}
default_provider: env

# Enable automatic masking of secrets in logs and output
enable_masking: true

# Timeout for secret operations (seconds)
timeout_seconds: 30

# Enable caching for performance
enable_caching: true

# Cache TTL in seconds
cache_ttl_seconds: 300

# Secret provider configurations
providers:
  # Environment variable provider
  env:
    type: environment
    # Optional prefix for environment variables
    # If specified, looks for WRKFLW_SECRET_* variables
    # prefix: "WRKFLW_SECRET_"
  
  # File-based secret storage
  file:
    type: file
    # Path to secrets file (supports JSON, YAML, or environment format)
    path: "~/.wrkflw/secrets.json"
  
  # HashiCorp Vault (requires vault-provider feature)
  vault:
    type: vault
    url: "https://vault.example.com"
    auth:
      method: token
      token: "${VAULT_TOKEN}"
    mount_path: "secret"
  
  # AWS Secrets Manager (requires aws-provider feature)
  aws:
    type: aws_secrets_manager
    region: "us-east-1"
    # Optional role to assume for cross-account access
    role_arn: "arn:aws:iam::123456789012:role/SecretRole"
  
  # Azure Key Vault (requires azure-provider feature)
  azure:
    type: azure_key_vault
    vault_url: "https://myvault.vault.azure.net/"
    auth:
      method: service_principal
      client_id: "${AZURE_CLIENT_ID}"
      client_secret: "${AZURE_CLIENT_SECRET}"
      tenant_id: "${AZURE_TENANT_ID}"
  
  # Google Cloud Secret Manager (requires gcp-provider feature)
  gcp:
    type: gcp_secret_manager
    project_id: "my-project-id"
    # Optional service account key file
    key_file: "/path/to/service-account.json"
