Docs / Operations

Secret refs (env and file)

TSIG, keytabs, PowerDNS tokens, webhook HMAC. Lattice stores a ref, not the secret, after create.

On DNS servers and Webhooks, secret fields look like:

env:LATTICE_TSIG_SECRET
file:/etc/lattice/lattice.keytab
env:LATTICE_POWERDNS_API_KEY
env:LATTICE_WEBHOOK_SECRET

The worker and dhcpd process read the env or file at runtime. The console will not show the bytes again. Put the value in the unit’s EnvironmentFile= or a tmpfs file with mode 0600. file: must be a full path — relative paths and names with slashes are rejected.

Wrong ref → outbox errors, not a rolled-back lease. Fix the file, then retry dead letters (Outbox).

Do not paste a TSIG secret into a reservation description or a ticket.