configuration-credentials

Configuration Credentials

Purpose

Use this skill to configure reusable credentials <label> blocks. These are parsed by caddyfile_credentials.go into go-authcrunch generic credentials. The Caddyfile block label becomes authcrunch's required credential name.

Credentials vs Secrets

Use credentials to create a named authcrunch credential object: a reusable name, username, password, and optional domain tuple that another configuration section can reference, such as an email messaging provider.

Use secrets to configure an external security.secrets manager and expose lookup values with the secrets:<secret_id>:<key> syntax. A secret lookup is not a credential object by itself; it is a placeholder-like value that caddy-security resolves during provisioning.

The two can be combined: put password "secrets:smtp:password" inside a credentials smtp_root block when the consumer needs a named credential, but the password should come from a secrets manager. configuration-secrets owns manager blocks and lookup rules.

Shape

{
	security {
		credentials smtp_root {
			username root
			password {env.SMTP_PASSWORD}
			domain example.com
		}
	}
}

The block accepts:

• username <username>
• password <password>
• domain <name>

Only generic username/password credentials are exposed through the Caddyfile. Do not add name or kind inside the block; caddy-security injects name from <label>, and unsupported inner keys fail parsing.

username and password are required by go-authcrunch after runtime resolution. domain is optional. SMTP sending in go-authcrunch uses the resolved username and password; include domain only when a downstream consumer expects it.

All values are single tokens after Caddyfile parsing. Quote values containing spaces. Runtime environment and secret replacements also remain one argument; embedded spaces, quotes, and newlines must survive unchanged. Follow runtime resolution when changing the encoded-instruction path.