domain: kamal-deploy.org · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Store secrets in .kamal/secrets (Kamal looks for <secrets_path>-common first, then <secrets_path>, or per-destination <secrets_path>.<destination> when using -d)
Kamal loads this file automatically via dotenv — reference values like REGISTRY_PASSWORD and RAILS_MASTER_KEY directly as environment assignments
Use command substitution for values pulled from files or tools, e.g. an assignment that shells out to read a local key file
For password managers, use kamal secrets fetch --adapter <1password|lastpass|bitwarden|bitwarden-sm|aws_secrets_manager|doppler|gcp|passbolt> ... then kamal secrets extract <NAME> <fetch-output> inside the secrets file
Run kamal deploy — env vars are applied automatically on every deploy in Kamal 2, no separate sync step needed
Known gotchas
kamal envify and kamal env were removed in Kamal 2 — there is no separate secrets lifecycle anymore; deploy always applies current values
The doppler and passbolt adapters ignore the --account flag if you pass one — only some adapters (1Password, LastPass, Bitwarden, AWS, GCP) actually use it
For GCP, omitting --from with the default account/project gives the shortest valid invocation, but forgetting the project entirely for a non-default account will fail unexpectedly
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?