greenpau Configuration Credentials
Purpose
Use this skill to configure reusable credentials <label> blocks. These are
parsed by caddyfile_credentials.go into go-authcrunch generic credentials.
The Caddyfile block label becomes authcrunch's required credential name.
Credentials vs Secrets
Use credentials to create a named authcrunch credential object: a reusable
name, username, password, and optional domain tuple that another
configuration section can reference, such as an email messaging provider.
Use secrets to configure an external security.secrets manager and expose
lookup values with the secrets:<secret_id>:<key> syntax. A secret lookup is
not a credential object by itself; it is a placeholder-like value that
caddy-security resolves during provisioning.
The two can be combined: put password "secrets:smtp:password" inside a
credentials smtp_root block when the consumer needs a named credential, but
the password should come from a secrets manager. Use configuration-secrets
for the manager block and lookup rules.
Shape
security {
credentials smtp_root {
username root
password {env.SMTP_PASSWORD}
domain example.com
}
}
The block accepts:
username <username>password <password>domain <name>
Only generic username/password credentials are exposed through the Caddyfile.
Do not add name or kind inside the block; caddy-security injects name
from <label>, and unsupported inner keys fail parsing.
username and password are required by go-authcrunch after runtime
resolution. domain is optional. SMTP sending in go-authcrunch uses the
resolved username and password; include domain only when a downstream
consumer expects it.
All values are single tokens after Caddyfile parsing. Quote values containing spaces.
Guidance
Use environment placeholders or secret lookups for passwords:
password {env.SMTP_PASSWORD}
password "secrets:smtp:password"
Secret lookups must use the secrets:<secret_id>:<key> shape and require a
matching secrets <plugin> <secret_id> block from configuration-secrets.
Caddy-security resolves {env.*} and secrets:*:* values before
go-authcrunch validates credentials.
Placeholders may be used in the block label and fields, but references must
resolve to the same final name. For example, a messaging provider's
credentials <credential_name> value must match the resolved credentials block
label.
Use labels that describe the consumer, such as smtp_root,
registration_smtp, or mailgun_smtp, rather than the secret value itself.
When the credential is consumed by email messaging, coordinate with
configuration-messaging. Non-passwordless email providers require a
credentials <credential_name> reference; passwordless email providers must
not also set credentials.
LDAP bind settings are not wired through reusable credentials blocks. LDAP
identity stores configure bind credentials directly with their own username
and password directives.
Fixtures
Use these examples:
caddyfile_credentials_test.go.testdata/caddyfile_adapt/testcase_authenticate_with_credentials.Caddyfile.testdata/caddyfile_adapt/testcase_authenticate_with_registration.Caddyfile.