tancheng33/dsh-credentials-vault ↗★ 0
dsh-credentials-vault
HashiCorp Vault backend for the DeepSeek Harness credential seam: central secrets, AppRole machine auth, rotation without restart, and no long-lived provider key on the agent host
AI Analysis
核心用途是避免在本地明文存储敏感 API 密钥，实现凭据的集中安全管理与无重启热轮转。适合企业级用户或已有 Vault 基础设施的安全敏感型团队。
Install
$
npx -p @deepseek-ai/dsh dsh plugin --profile web add github:tancheng33/dsh-credentials-vaultREADME
Read the full README ↗Configuration
| Key | Default | Meaning |
|---|---|---|
address | http://127.0.0.1:8200 | Vault base address. |
namespace | '' | Vault Enterprise namespace. Empty sends no header. |
mount | secret | KV secrets-engine mount point. |
path | dsh | Path under the mount holding the credential map. |
kvVersion | 2 | KV engine version. v2 gives compare-and-swap and versioning. |
tokenRef | VAULT_TOKEN | Env var holding a Vault token. Used when AppRole is not configured. |
approleMount | approle | AppRole auth mount path. |
roleIdRef | VAULT_ROLE_ID | Env var holding an AppRole role id. |
secretIdRef | VAULT_SECRET_ID | Env var holding an AppRole secret id. |
readOnly | false | Refuse set/unset entirely. |
environmentWins | true | Let an inherited env var shadow Vault, as the local provider does. |
cacheTtlMs | 0 | Cache the secret map for this many ms. 0 reads per operation. |
timeoutMs | 10000 | Vault request timeout. |
Nothing secret goes in this file. tokenRef, roleIdRef, and secretIdRef name environment variables carrying the bootstrap credential. The point of the plugin is that long-lived provider keys are not in configuration, and that has to hold for its own bootstrap too.