Doppler Secrets

2. Never expose secret values.

• Never print secrets to stdout/stderr.
• Never include secret values in LLM/tool message bodies, prompts, or files.
• Never serialize secrets into files, stack traces, debug dumps, or shell history.
• When commands carry tokens, set export HISTIGNORE='doppler*:export DOPPLER_TOKEN*' first.

3. Prefer env injection over value retrieval.

• Primary pattern: doppler run --project=<p> --config=<c> -- <command>.
• Application reads injected env vars internally.
• Avoid doppler secrets get / doppler secrets download unless strictly required, and never log the output.

4. Bind repos with a committed doppler.yaml.

• Project-root doppler.yaml lets doppler setup --no-interactive work for teammates and CI.
• Per-user state lives in ~/.doppler/.doppler.yaml and must NOT be hand-edited.

Detection:

if ! command -v doppler >/dev/null 2>&1; then
  echo "doppler CLI missing — installing" >&2
  # run an install branch from the table below
fi
doppler --version

OS-specific install (use the first matching branch):

• macOS (Homebrew):

  brew install dopplerhq/cli/doppler
  

• Linux — Debian/Ubuntu (apt, signed repo, persistent):

  sudo apt-get update
  sudo apt-get install -y apt-transport-https ca-certificates curl gnupg
  curl -sLf --retry 3 --tlsv1.2 --proto "=https" \
    'https://packages.doppler.com/public/cli/gpg.DE2A7741A397C129.key' \
    | sudo gpg --dearmor -o /usr/share/keyrings/doppler-archive-keyring.gpg
  echo "deb [signed-by=/usr/share/keyrings/doppler-archive-keyring.gpg] https://packages.doppler.com/public/cli/deb/debian any-version main" \
    | sudo tee /etc/apt/sources.list.d/doppler-cli.list
  sudo apt-get update && sudo apt-get install -y doppler
  

• Linux — RHEL/CentOS/Fedora (yum/dnf):

  sudo rpm --import 'https://packages.doppler.com/public/cli/gpg.DE2A7741A397C129.key'
  curl -sLf --retry 3 --tlsv1.2 --proto "=https" \
    'https://packages.doppler.com/public/cli/config.rpm.txt' \
    | sudo tee /etc/yum.repos.d/doppler-cli.repo
  sudo dnf install -y doppler || sudo yum install -y doppler
  

• Linux/macOS fallback or CI — official install script:

  (curl -Ls --tlsv1.2 --proto "=https" --retry 3 https://cli.doppler.com/install.sh \
    || wget -t 3 -qO- https://cli.doppler.com/install.sh) | sh
  

• Windows (PowerShell, winget):

  winget install doppler
  

• Docker / containers (no package manager): bake into the image — see templates/Dockerfile.doppler.snippet.

Authoritative sources (consult only if you suspect a stale flag):

• https://docs.doppler.com/docs/install-cli
• https://github.com/DopplerHQ/cli

After install, verify:

doppler --version

Do NOT proceed if the CLI is still missing — report the install failure and stop.

──────────────────────────────────────────────────────── PART A — AD HOC SCRIPTS ────────────────────────────────────────────────────────

──────────────────────────────────────────────────────── PART B — PROJECTS / LONG-LIVED APPLICATIONS ────────────────────────────────────────────────────────

For team-wide reproducibility, also commit a doppler.yaml at the repo root (see templates/doppler.yaml):

setup:
  - project: my-app
    config: dev

Monorepo variant:

setup:
  - path: backend/
    project: my-app-api
    config: dev
  - path: frontend/
    project: my-app-web
    config: dev

Teammates and CI then run:

doppler setup --no-interactive

Create:

# interactive setup, then mint
doppler setup
doppler configs tokens create ci-deploy --plain

# or single-shot
doppler configs tokens create ci-deploy \
  --project my-app --config prd --plain

Ephemeral token (auto-expires):

DOPPLER_TOKEN=$(doppler configs tokens create job-$(date +%s) \
  --project my-app --config prd --max-age 5m --plain)

Revoke:

doppler configs tokens revoke -p my-app -c prd dp.st.prd.xxxx

Auth precedence (highest → lowest): --token flag → DOPPLER_TOKEN env → --project/--config flags → directory scope in ~/.doppler/.doppler.yaml.

Pattern B — host-side injection (no Doppler in image):

doppler run -- docker compose up

Never COPY .env into an image. Never bake DOPPLER_TOKEN into a layer.

1. Doppler Kubernetes Operator (recommended) — syncs Doppler configs into native Secret objects; pods consume via envFrom. Install via Helm; see https://docs.doppler.com/docs/kubernetes-operator. The Operator handles rotation; no doppler binary in the image.

2. doppler run inside containers using DOPPLER_TOKEN from a K8s Secret:

kubectl create secret generic doppler-token \
  --from-literal=DOPPLER_TOKEN='dp.st.prd.xxxx'

spec:
  containers:
    - name: app
      image: my-app:latest
      envFrom:
        - secretRef:
            name: doppler-token

Prefer (1) for production. Use (2) when the Operator is not available.

──────────────────────────────────────────────────────── COMMON FAILURES & FIXES ────────────────────────────────────────────────────────

──────────────────────────────────────────────────────── VERIFICATION CHECKLIST ────────────────────────────────────────────────────────