From aa0de051a8504aa0ce81d6736d2f53a5ed6d4856 Mon Sep 17 00:00:00 2001 From: Barry Norman Date: Tue, 18 Aug 2026 22:30:41 +0200 Subject: [PATCH] docs(secrets): add Phase.dev vault provider Document Phase REST API setup (Service Account token + SSE), reference format, and list Phase alongside existing secrets providers. Co-authored-by: Cursor --- .../docs/core/enterprise/audit-logs.mdx | 2 +- .../docs/core/enterprise/custom-roles.mdx | 2 +- .../docs/core/secrets-providers/index.mdx | 4 +- .../docs/core/secrets-providers/meta.json | 3 +- .../docs/core/secrets-providers/phase.mdx | 46 +++++++++++++++++++ apps/docs/content/docs/core/variables.mdx | 2 +- 6 files changed, 54 insertions(+), 5 deletions(-) create mode 100644 apps/docs/content/docs/core/secrets-providers/phase.mdx diff --git a/apps/docs/content/docs/core/enterprise/audit-logs.mdx b/apps/docs/content/docs/core/enterprise/audit-logs.mdx index d08f16d4..6bb09dbf 100644 --- a/apps/docs/content/docs/core/enterprise/audit-logs.mdx +++ b/apps/docs/content/docs/core/enterprise/audit-logs.mdx @@ -35,7 +35,7 @@ Audit Logs track every meaningful action in your organization: - **Infrastructure** — Changes to servers, registries, certificates, SSH keys, and S3 destinations. - **Backups & Schedules** — Creating, updating, or deleting backups, volume backups, and scheduled jobs. - **Notifications** — Changes to notification providers. -- **Secrets Providers** — Creating, updating, or deleting connections to external secret managers (HashiCorp Vault / OpenBao, Infisical, AWS Secrets Manager, Doppler, Azure Key Vault, Scaleway Secret Manager). See [Secrets Providers](/docs/core/secrets-providers). +- **Secrets Providers** — Creating, updating, or deleting connections to external secret managers (HashiCorp Vault / OpenBao, Infisical, AWS Secrets Manager, Doppler, Azure Key Vault, Scaleway Secret Manager, Phase). See [Secrets Providers](/docs/core/secrets-providers). - **DNS Providers** — Creating, updating, or deleting DNS provider connections (Cloudflare, AWS Route53). See [DNS Providers](/docs/core/dns-providers). ## Filtering diff --git a/apps/docs/content/docs/core/enterprise/custom-roles.mdx b/apps/docs/content/docs/core/enterprise/custom-roles.mdx index 230f0df1..314e990d 100644 --- a/apps/docs/content/docs/core/enterprise/custom-roles.mdx +++ b/apps/docs/content/docs/core/enterprise/custom-roles.mdx @@ -228,7 +228,7 @@ View the audit log of actions performed in the organization. ### Secrets Providers -Manage connections to external secret managers (HashiCorp Vault / OpenBao, Infisical, AWS Secrets Manager, Doppler, Azure Key Vault, Scaleway Secret Manager) used to reference secrets in environment variables. See [Secrets Providers](/docs/core/secrets-providers). +Manage connections to external secret managers (HashiCorp Vault / OpenBao, Infisical, AWS Secrets Manager, Doppler, Azure Key Vault, Scaleway Secret Manager, Phase) used to reference secrets in environment variables. See [Secrets Providers](/docs/core/secrets-providers). - **Read** — View provider names and secret names (powers the `${{vault.*}}` autocomplete). - **Create** — Add new secrets providers. diff --git a/apps/docs/content/docs/core/secrets-providers/index.mdx b/apps/docs/content/docs/core/secrets-providers/index.mdx index 18d194ea..7645b648 100644 --- a/apps/docs/content/docs/core/secrets-providers/index.mdx +++ b/apps/docs/content/docs/core/secrets-providers/index.mdx @@ -1,6 +1,6 @@ --- title: Secrets Providers -description: "Reference secrets from external secret managers (HashiCorp Vault, OpenBao, Infisical, AWS Secrets Manager, Doppler, Azure Key Vault, Scaleway Secret Manager) directly in your environment variables." +description: "Reference secrets from external secret managers (HashiCorp Vault, OpenBao, Infisical, AWS Secrets Manager, Doppler, Azure Key Vault, Scaleway Secret Manager, Phase) directly in your environment variables." --- import { Callout } from "fumadocs-ui/components/callout"; @@ -28,6 +28,7 @@ Supported providers: - [Doppler](/docs/core/secrets-providers/doppler) - [Azure Key Vault](/docs/core/secrets-providers/azure) - [Scaleway Secret Manager](/docs/core/secrets-providers/scaleway) +- [Phase](/docs/core/secrets-providers/phase) ## Reference Syntax @@ -46,6 +47,7 @@ ${{vault..}} | Doppler | `` | `DB_PASSWORD` | | Azure Key Vault | `` | `db-password` | | Scaleway Secret Manager | `[folder/][:field]` | `prod/database:password` | +| Phase | `` | `DB_PASSWORD` | References work in every place that flows into a deployment: diff --git a/apps/docs/content/docs/core/secrets-providers/meta.json b/apps/docs/content/docs/core/secrets-providers/meta.json index 47eb50d0..bcf9b2c9 100644 --- a/apps/docs/content/docs/core/secrets-providers/meta.json +++ b/apps/docs/content/docs/core/secrets-providers/meta.json @@ -6,6 +6,7 @@ "aws", "doppler", "azure", - "scaleway" + "scaleway", + "phase" ] } diff --git a/apps/docs/content/docs/core/secrets-providers/phase.mdx b/apps/docs/content/docs/core/secrets-providers/phase.mdx new file mode 100644 index 00000000..249b3597 --- /dev/null +++ b/apps/docs/content/docs/core/secrets-providers/phase.mdx @@ -0,0 +1,46 @@ +--- +title: Phase +description: "Use Phase.dev secrets in your Dokploy environment variables." +--- + +import { Callout } from "fumadocs-ui/components/callout"; + +## Create a Service Account Token + +Dokploy talks to Phase over the **REST API** using a **Service Account** token. CLI/SDK `pss_*` tokens are not accepted for this integration. + +1. In Phase, open your organization and create (or open) a **Service Account**. +2. Grant the account access to the App and Environment you want Dokploy to read. +3. Create a **REST API token** for that Service Account and copy it. + + + The Phase App must have **Server-side Encryption (SSE)** enabled. Without SSE, the REST secrets API cannot return decrypted values and Dokploy's Test Connection / deploy-time fetch will fail. + + +## Configuration + +In **Settings → Secrets → Add Provider**, choose **Phase** and fill in: + +- **Name**: the identifier used in references, e.g. `phase-prod`. +- **Service Account REST API token**: the token from above. +- **App ID**: the Phase App ID. +- **Environment**: the Phase environment name (e.g. `production`). +- **Path** (optional): secret path prefix; defaults to `/`. +- **API URL** (optional): defaults to `https://api.phase.dev`. Self-hosted Phase usually uses your own API base URL. + +Use **Test Connection** to validate the token, App ID, environment, and SSE before saving, then assign the projects/environments where the provider may be used. + + + A provider points at a single Phase App + Environment (+ path). For several environments, create one provider per environment and assign each to the matching Dokploy environments. + + +## Reference Format + +Phase secrets are flat key/value pairs within the configured path, so references use the secret name directly: + +```bash +DATABASE_URL=${{vault.phase-prod.DATABASE_URL}} +STRIPE_KEY=${{vault.phase-prod.STRIPE_KEY}} +``` + +The autocomplete lists the real secret names returned by the Phase REST secrets API for that App/Environment/path. diff --git a/apps/docs/content/docs/core/variables.mdx b/apps/docs/content/docs/core/variables.mdx index 0de32458..5643468a 100644 --- a/apps/docs/content/docs/core/variables.mdx +++ b/apps/docs/content/docs/core/variables.mdx @@ -107,7 +107,7 @@ DATABASE_URL=postgresql://${{DATABASE_USER}}:${{DATABASE_PASSWORD}}@service-data ## Secrets from External Vaults -Besides shared variables, you can reference secrets stored in an external secret manager (HashiCorp Vault/OpenBao, Infisical, AWS Secrets Manager, Doppler, Azure Key Vault): +Besides shared variables, you can reference secrets stored in an external secret manager (HashiCorp Vault/OpenBao, Infisical, AWS Secrets Manager, Doppler, Azure Key Vault, Scaleway Secret Manager, Phase): ```bash DB_PASSWORD=${{vault.prod-vault.myapp/prod:DB_PASSWORD}}