Teller Secret Manager

Run teller new to start an interactive setup. You will be prompted to select your secret providers (e.g., hashicorp, aws_secretsmanager, ssm, dotenv, google_secretmanager, hashicorp_consul). This creates a .teller.yml file.

$ teller new

You can install Teller by downloading a pre-built binary from the releases page or by building it from source using Cargo.

$ cd teller-cli
$ cargo install --path .

To inject Teller secrets directly into your current shell session (e.g., in a .zshrc or .bashrc), use eval with teller sh.

eval "$(teller sh)"

The .teller.yml file defines providers and their maps. Each map contains:

• id: A unique identifier for the map used in CLI operations.
• path: The root path to fetch key-values from (supports Tera templating like {{ get_env(...) }}).
• keys: (Optional) A mapping to rename keys.
  • Use == to map to the same key name.
  • Use KEY_NAME: NEW_NAME to rename a key from the source to a new name.

Example configuration:

providers:
  hashi_1:
    kind: hashicorp
    maps:
      - id: test-load
        path: /{{ get_env(name="TEST_LOAD_1", default="test") }}/users/user1
        keys:
          GITHUB_TOKEN: ==
          mg: FOO_BAR
  dot_1:
    kind: dotenv
    maps:
      - id: stg
        path: VAR_{{ get_env(name="STAGE", default="development") }}

Inject Teller secrets into a Docker container as environment variables using a single command:

$ docker run --rm -it --env-file <(teller env) alpine sh

To use a .env file as a secret manager provider in Teller, define a provider with the kind: dotenv in your configuration. You can optionally specify create_on_put to allow Teller to create the file if it does not already exist when writing new data.

providers:
 dotenv1:
   kind: dotenv
   create_on_put: true

providers:
 dotenv1:
   kind: dotenv
   # options: ...

To use HashiCorp Consul as a secret provider in Teller, add it to your teller.yml configuration. You can specify the connection details under the provider name using the kind: hashicorp_consul identifier.

Available options:

• address: The Consul server address. If not provided, Teller will look for the CONSUL_HTTP_ADDR environment variable.
• token: The Consul ACL token. If not provided, Teller will look for the CONSUL_HTTP_TOKEN environment variable.
• dc: The specific datacenter to query.

providers:
 consul1:
   kind: hashicorp_consul
   # options: ...

To use Google Secret Manager (GSM) as a provider in teller, add it to your configuration file under the providers key. Use kind: google_secretmanager to specify the provider type.

Authentication

The provider uses the default Google Cloud Application Default Credentials (ADC) strategy. It searches for credentials in the following order:

1. The path specified in the GOOGLE_APPLICATION_CREDENTIALS environment variable.
2. The file $HOME/.config/gcloud/application_default_credentials.json.

If you require specific configuration options, please open an issue in the repository.

providers:
 gsm1:
  kind: google_secretmanager
  # options: ...

To use AWS SSM as a secret provider in Teller, define a provider with kind: ssm in your teller.yml. You can provide simplified configuration options to specify credentials, region, and endpoint URL.

If no options are provided, Teller will attempt to use the default AWS SDK credential loading chain (e.g., environment variables, IAM roles, or shared credentials file).

In your teller.yml configuration, you can use the == operator within your provider maps to indicate that a secret should be mapped to a key with the same name.

If you provide a value other than ==, the key on the left side of the mapping is transformed into the key name on the right side. For example, if you have a mapping original_key: new_key, the secret from original_key will be available as new_key.