The vault and accounts

Platform secrets never live in the repository or in .env: .env holds only the link to a vault (Bitwarden / Vaultwarden, HashiCorp Vault / OpenBao, a KeePassXC file). Secrets are named <platform>/<key>, e.g. mastodon/token. Here the env backend stands in for a vault: it reads AMOORION_SECRET_<PLATFORM>_<KEY> variables, meant for development.

import os

from amoorion import Amoorion

# A sandbox for this whole notebook: secrets only from variables, the inbox and
# the dataset in a temporary folder. Nothing here can touch your real setup.
Amoorion.init()

PosixPath('/tmp/amoorion-u_5xlp23')

from amoorion.vault import VaultLink, open_vault

# The link of the environment; `init` made it the `env` kind.
link = VaultLink.from_env()

print(link)

# Opening asks nothing yet.
vault = open_vault(link)

kind='env' addr=None token=None path=None

Every plugin says which secrets it needs. accounts tells which platforms have them all, and never shows a value:

from amoorion.methods import Accounts


# A small report on all platforms.
def ready():

    for status in Accounts(vault)():
        print(
            f"{status['platform']:16} {'ready' if status['ready'] else 'missing: ' + ', '.join(status['missing'])}"
        )


ready()

blogger          missing: address, smtp-uri, smtp-password
bluesky          missing: username, password
discord          missing: token, channel
discord-webhook  missing: url
dryrun           ready
email            missing: to, smtp-uri, smtp-password, imap-uri, imap-password
facebook         missing: page-id, page-token
mastodon         missing: uri, token
matrix           missing: uri, token, room
ntfy             missing: topic
telegram         missing: token, chat
tumblr           missing: consumer-key, consumer-secret, token, token-secret, blog
x                missing: api-key, api-secret, access-token, access-secret

Give Mastodon its two secrets (made-up values) and ask again:

# Secrets of the `env` vault are variables; these are made up.
os.environ["AMOORION_SECRET_MASTODON_URI"] = "https://mastodon.example"

os.environ["AMOORION_SECRET_MASTODON_TOKEN"] = "not-a-real-token"

# Mastodon is ready now.
ready()

blogger          missing: address, smtp-uri, smtp-password
bluesky          missing: username, password
discord          missing: token, channel
discord-webhook  missing: url
dryrun           ready
email            missing: to, smtp-uri, smtp-password, imap-uri, imap-password
facebook         missing: page-id, page-token
mastodon         ready
matrix           missing: uri, token, room
ntfy             missing: topic
telegram         missing: token, chat
tumblr           missing: consumer-key, consumer-secret, token, token-secret, blog
x                missing: api-key, api-secret, access-token, access-secret

With a real vault, .env says where it is instead, e.g. for Bitwarden:

AMOORION_VAULT=bitwarden
AMOORION_VAULT_TOKEN=<the session of `bw unlock --raw`>

and the item amoorion/mastodon holds the fields uri and token. Each platform’s README lists its keys.