Porkbun

A Porkbun account is declared under meta.registrants.porkbun, keyed by an account name. It is given the commands that produce its API credentials:

meta.registrants.porkbun.<account> = {
  apiKeyCommand = "pass show dns/porkbun/api-key";
  secretApiKeyCommand = "pass show dns/porkbun/secret-key";
};

Both apiKeyCommand and secretApiKeyCommand are local commands whose output is the credential, so the secrets stay out of the Hive.

Credentials as Terraform variables

For Porkbun the credentials are injected as Terraform variables by default, so the DNS resources you declare in Terranix can use them without further wiring. The relevant fields are:

• terraformSecrets controls the injection. It defaults to true; set it to false to keep the credentials out of Terraform's variables.
• apiKeyVariable and secretKeyVariable set the variable names Terraform sees. They default to porkbun_api_key and porkbun_secret_api_key.

The defaults are usually what you want. Override the variable names only when a module you are using expects different ones:

meta.registrants.porkbun.<account> = {
  apiKeyCommand = "pass show dns/porkbun/api-key";
  secretApiKeyCommand = "pass show dns/porkbun/secret-key";
  apiKeyVariable = "pb_key";
  secretKeyVariable = "pb_secret";
};