Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.slipway.sh/llms.txt

Use this file to discover all available pages before exploring further.

slipway has three scopes for both variables and secrets:
ScopeStored onReference in slipway.yaml
EnvironmentThe Environment row${secret.env.NAME} / ${var.env.NAME}
RepositoryThe Repository row${secret.repo.NAME} / ${var.repo.NAME}
OrganizationThe Organization row${secret.org.NAME} / ${var.org.NAME}
The bare shorthand — ${secret.NAME} / ${var.NAME} — walks env → repo → org at resolve time, taking the first match. Convoy-bound deployments learn env values automatically; standalone single-repo deployments simply skip the env layer (no values, no errors).

​
Secrets

  • Encrypted at rest. Slipway never returns secret values after creation — the convoy detail page lists names only.
  • Values reach your containers only as environment variables at startup. They don’t appear in the deployment row, the pod definition, or anywhere else a viewer of your org would see them.
  • Rotating a convoy secret takes effect on the next redeploy. The current deploy’s containers keep running with the values they were built with.

​
Variables

  • Plaintext key/value, shown inline on the deployment detail page.
  • Same scope-precedence rules as secrets, but the value is visible.
  • Useful for switches like LOG_LEVEL, FEATURE_X, build-time REGISTRY_HOST.

​
Worked example

Repo web has a repo-scoped ${secret.DATABASE_URL} pointing at a single dev database. You want the staging convoy to use a different DB for the whole convoy.
  1. In staging’s Secrets tab, set DATABASE_URL to the staging connection string.
  2. Redeploy the convoy.
  3. Every component using ${secret.DATABASE_URL} (bare form) now resolves to the env value. The component’s ${secret.repo.DATABASE_URL} (explicit) is unaffected and still uses the repo value.

​
Strict vs shorthand

Explicit scopes never fall through. ${secret.repo.X} will fail with “missing repo secrets: X” if the repo doesn’t define it, even if the env or org has it. Use the shorthand when you want fallback; use explicit when you want a strict lookup.

​
What doesn’t migrate

Saving a convoy as a charter captures variable + secret keys, not values. When you instantiate a new convoy from a charter, the composer prompts you to fill in each declared key. This is on purpose — secrets are environment-specific (the staging DB isn’t the prod DB).