Configuration
Password resolution, environment variables, and global flags
Global Flags
These flags work with any command:
| Flag | What it does |
|---|---|
-p, --password | Pass the master password inline |
--password-file | Read password from a file (use - for stdin) |
Password Resolution Order
Obscuro checks these sources in order and uses the first one it finds:
--passwordflag--password-fileflag- OS keychain (keyed by your vault's salt)
OBSCURO_PASSWORDenvironment variable- Interactive TTY prompt
Environment Variables
| Variable | What it does |
|---|---|
OBSCURO_PASSWORD | Master password (skips the interactive prompt) |
OBSCURO_NO_UPDATE_CHECK | Set to 1 to stop update checks |
EDITOR | Editor for obscuro edit (defaults to vi) |
CI/CD Usage
In automated environments there's no TTY to prompt for a password, so pass it via env var or flag:
export OBSCURO_PASSWORD="$VAULT_SECRET"
obscuro inject < manifests.yaml > decrypted.yamlOr with a flag:
obscuro --password-file /run/secrets/obscuro-pw inject < manifests.yaml