Bootstrap secret inputs

[bootstrap.secrets] declares the sensitive inputs a bootstrap configuration needs without storing their values in mise configuration. Values come from the environment, making secret managers such as fnox the provider boundary rather than adding provider-specific credentials to mise.

[bootstrap.secrets]
cache_token = "MISE_CACHE_TOKEN"
database_password = {
  env = "PRODUCTION_DATABASE_PASSWORD",
  description = "Production database password",
}

[bootstrap.files."/etc/example/service.env"]
content = '''
CACHE_TOKEN={{ secret(name="cache_token") }}
DATABASE_PASSWORD={{ secret(name="database_password") }}
'''
template = true
owner = "root"
group = "root"
mode = "0600"

The short declaration maps a logical name directly to an environment variable. The table form also accepts description and allow_empty = true; empty values are rejected by default. mise resolves only the inputs referenced by selected file templates; an unused declaration does not block unrelated files. Referenced inputs are resolved and every template is rendered before any full-bootstrap mutation starts, so a missing input cannot leave a partially rendered file or allow earlier bootstrap steps to run.

The .env example assumes values that can be written as single-line assignments. The secret() function inserts the value; it does not quote or escape it for shell, JSON, TOML, or another target format. Render and encode values according to the format consumed by the service, especially for quotes or newlines.

Supply inputs and check availability

Use fnox to inject provider-backed values into the bootstrap process:

fnox exec -- mise bootstrap --yes
fnox exec -- mise bootstrap plan

This is intentionally a loose integration. The machine running mise does not need fnox when its environment has already been populated, and mise does not know whether a value came from fnox, a CI secret, systemd, or a shell.

For an attended one-off run, --prompt-secrets securely prompts for missing values. Prompted values remain in memory and are not exported:

mise bootstrap --prompt-secrets --yes
mise bootstrap files apply --prompt-secrets
mise bootstrap plan --prompt-secrets

mise bootstrap secrets status reports logical names, environment variable names, and available, missing, empty, or invalid_unicode; it never prints values. Add --json for machine-readable output or --missing to exit 1 when an input is unavailable.

For remote bootstrap, the local environment is not copied to the SSH target. Supply inputs on the target or use --prompt-secrets for an attended run.

mise redacts resolved values from its output. Plans, dry runs, status output, and privileged-helper output contain no rendered file content. There is no command to reveal a bootstrap secret.