Skip to main content
Version: v5.7.0

opschain runner migrate-vault-env

Included from Basic tier

The one-off migration of a Rails-era MintPress runner host. The OPSCHAIN_VAULT_* runner-host environment lane retired: a runner's vault access is the secrets_providers section of <runner dir>/config.yaml, and a runner started with the variables and no section refuses to start, naming this command. Run it once, on the host, with the same environment the runner used to start with:

OPSCHAIN_VAULT_ADDRESS=https://bao.corp:8200 OPSCHAIN_VAULT_TOKEN=$VT \
  opschain runner migrate-vault-env
wrote secrets provider "vault" to /home/runner/.opschain/runner/config.yaml from the OPSCHAIN_VAULT_* environment (the credential stays in the environment, referenced by name) - start the runner again

It writes one entry, code vault — the code the server's own upgrade seed gives the legacy configuration, so the migrated host declares the provider the estate already addresses — with the kind (openbao, or hashicorp-vault when OPSCHAIN_VAULT_TYPE says so), address, mount, KV version, the auth method inferred from the halves present (token / userpass / approle) and the TLS posture from OPSCHAIN_VAULT_SSL_VERIFY, OPSCHAIN_VAULT_SSL_CA_CERT or the CLIENT_OPTIONS JSON. The credential is referenced by its variable name (credential_env: OPSCHAIN_VAULT_TOKEN / _PASSWORD / _SECRET_ID): the material stays in the environment and never lands in the file. Edit the entry afterwards to pin the material another way (credential_file), rename the code, or add further providers (opschain docs runner-executors).

On a host without the variables the command does nothing (no OPSCHAIN_VAULT_* variables in the environment: nothing to migrate); on a file that already declares vault it leaves the file untouched and says so. Other top-level keys in config.yaml are preserved.

Flags​

FlagMeaning
--dir <path>Runner state directory holding config.yaml (default: <opschain home>/runner).

Exit codes​

CodeMeaning
0The section was written, or there was nothing to migrate.
1The config file could not be read or written.

See also​

  • opschain docs cli/runner — the config file and the startup refusal.
  • opschain docs secrets-providers — resolution: runner and where references resolve.
  • opschain docs getting-started/pack-mintpress — the MintPress fleet's vault posture.