Configuration

These settings come from global flags and environment variables, not from fnox.toml. For the config file format, see the configuration reference.

age_key_file

• Type: option<path>
• Optional: true
• Since: 0.1.0
• Set with: --age-key-file, FNOX_AGE_KEY_FILE

Path to an age identity file for decrypting age secrets.

Used only when FNOX_AGE_KEY is unset and the age provider sets neither identity nor key_file; without it, fnox falls back to age.txt in the fnox config directory. Prefer key_file on the provider. The --age-key-file flag is deprecated and hidden, and overrides FNOX_AGE_KEY_FILE when both are set.

FNOX_AGE_KEY_FILE=~/.age/key.txt fnox get MY_SECRET

http_timeout

• Type: string
• Default: 30s
• Since: 1.16.0
• Set with: FNOX_HTTP_TIMEOUT

Timeout for HTTP requests that fnox makes itself.

Applies to lease backends such as Vault, GCP IAM, GitHub, and Cloudflare, to Lua plugin HTTP calls, and to the Azure App Configuration provider, so a slow server cannot hang fnox exec. Accepts a duration such as 30s, 2m, or 1h30m. 0 disables the timeout; a value that does not parse means 30s.

FNOX_HTTP_TIMEOUT=60s fnox exec -- ./my-app

FNOX_HTTP_TIMEOUT=10s fnox lease create my-lease --duration 1h

if_missing

• Type: option<string>
• Optional: true
• Since: 1.1.0
• Set with: --if-missing, FNOX_IF_MISSING

What to do when any secret cannot be resolved, overriding the config.

error fails the command, warn prints a warning and continues, and ignore continues silently. This beats every if_missing in the config. The full order is: --if-missing, FNOX_IF_MISSING, the secret's if_missing, the top-level if_missing, FNOX_IF_MISSING_DEFAULT, then warn. An unknown value prints a warning and means warn.

fnox exec --if-missing error -- ./my-app

FNOX_IF_MISSING=ignore fnox exec -- ./my-app

if_missing_default

• Type: option<string>
• Optional: true
• Since: 1.1.0
• Set with: FNOX_IF_MISSING_DEFAULT

What to do when a secret cannot be resolved, if the config does not say.

error fails the command, warn prints a warning and continues (the built-in default), and ignore continues silently. Unlike FNOX_IF_MISSING, it applies only to secrets with no if_missing in the secret or at the top level of the config. An unknown value prints a warning and means warn.

export FNOX_IF_MISSING_DEFAULT=error

export FNOX_IF_MISSING_DEFAULT=ignore

no_defaults

• Type: bool
• Default: false
• Since: 1.12.0
• Set with: --no-defaults, FNOX_NO_DEFAULTS

Use only the selected profile's secrets, without top-level [secrets].

By default a named profile inherits the top-level [secrets] table. With this set, only [profiles.<name>.secrets] (and the profile's own files) apply. --no-defaults overrides FNOX_NO_DEFAULTS.

fnox exec --profile dev --no-defaults -- ./my-app

FNOX_NO_DEFAULTS=true fnox exec --profile dev -- ./my-app

profile

• Type: list<string>
• Default: default
• Since: 0.1.0
• Set with: --profile, -P, FNOX_PROFILE

Profiles to use, separated by commas.

Selects which [profiles.<name>] tables and fnox.<name>.toml files apply. With several profiles, later ones override earlier ones. --profile overrides FNOX_PROFILE.

fnox get MY_SECRET --profile production

FNOX_PROFILE=aws,staging fnox exec -- ./deploy.sh

shell_integration_output

• Type: string
• Default: normal
• Since: 0.1.0
• Set with: FNOX_SHELL_OUTPUT

How much shell integration prints when it loads or unloads secrets.

none prints nothing, normal prints the keys that were loaded or unloaded, and debug also explains what the hook did, including why it exited early. off, false, and 0 also mean none; verbose also means debug. Any other value means normal.

export FNOX_SHELL_OUTPUT=none

export FNOX_SHELL_OUTPUT=debug