How to deal with programs that take a secret in a confilg file with other parameters

[bashfulrobot]

Hi there.

How can Agenix help with a secret needed in a configuration file?

IE

someapp.yaml

database:
  host: "localhost"
  port: 5432
  username: "admin"
  password: "supersecretpassword"

api:
  endpoint: "https://api.example.com"
  api_key: "exampleapikey123456"

smtp:
  server: "smtp.example.com"
  port: 587
  username: "[email protected]"
  password: "emailpassword"

secret_service:
  secret_key: "thisisaverysecretkey"

I know that agenix works easily if the program can take in a "password file", but what if the program does not support that? I guess, in some ways, you could do some voodoo with ENV VARs, but what if ENV VARs are also not an option?

Cheers!

[bashfulrobot]

Wait, or does this mean I can use age.secrets.<name>.path to encrypt the entire file and then place an unencrypted version in the right place?