Variables Options

variables

Workspace variables keyed by their full variable ID.

Prefixes determine storage: /var/* - Shared config (plaintext, NOT encrypted) /secret/* - Flat secrets (one SOPS file per variable) /computed/* - Nix-computed values (read-only)

Secret variable values are empty strings; the SOPS file is the source of truth. Plaintext variables store their value directly.

Example:

{
  # Shared config (plaintext, NOT encrypted)
   "/var/LOG_LEVEL" = { value = "info"; };
   "/var/API_VERSION" = { value = "v1"; };

  # Secret (value lives in vars/postgres-url.sops.yaml)
   "/secret/postgres-url" = { value = ""; };
 }

variables.<name>.id

Variable identifier. Format: //

This defaults to the attribute key, so it normally does not need to be written in config files.

Secret variables use a flat namespace: /secret/postgres-url -> .stack/secrets/vars/postgres-url.sops.yaml

Computed variables use /computed//: /computed/apps/web/port /computed/services/postgres/port

variables.<name>.isComputed

Whether this is a computed (read-only) variable

variables.<name>.isPlaintext

Whether this is a plaintext config variable (/var/*)

variables.<name>.isSecret

Whether this is a SOPS-encrypted secret

variables.<name>.isValsRef

Whether the value is a vals reference

variables.<name>.keyGroup

Key group extracted from ID (e.g., 'secret', 'var', 'computed')

variables.<name>.secretYamlKey

Deterministic YAML key used inside the per-variable SOPS file

variables.<name>.sopsFile

Path to the SOPS file for this keygroup (null for /var/* and /computed/*)

variables.<name>.value

The value of this variable.

For plaintext variables (/var/): the literal value. For secrets (/secret/): empty string (SOPS file is source of truth). For computed (/computed/*): the computed value from Nix.

Legacy: ref+sops:// values are still supported during migration.

variables.<name>.varName

Variable name extracted from ID (last path component)