barry.yaml

barry.yaml holds one Barry installation’s own settings: environment overrides for the services its bags declare, and references to the secrets the installation reads. It lives in the settings directory, ~/.config/barry/, or $XDG_CONFIG_HOME/barry/ when XDG_CONFIG_HOME holds an absolute path, or $BARRY_HOME/config/ when the BARRY_HOME environment variable names an instance. barry config show prints the directory. The file is optional, and Barry reads it each time a service starts and each time the installation needs a secret.

The file holds references, never secret values, so it can live in a dotfiles repository. Values stay in the private environment file, env in Barry’s data directory, which barry env set writes. Each reader parses only the key it uses, so services, secrets, and vault fail independently. installation-environment.ts and installation-secrets.ts read it.

A barry.yaml inside an identity’s directory is a different file: the older name for that identity’s identity.yaml. Barry still reads it, and the first change to the identity’s settings writes identity.yaml in its place and removes the old file. The identity.yaml reference covers its keys.

Overview

Every key barry.yaml accepts, with its type. Each key has its own section under Fields.

services: map
  <service-key>: object
    env: list of string
secrets: map
  <NAME>: object
    in: string  # required
    key: string
    item: string
    account: string
    field: string
vault: string

Fields

services

• Type: map
• Required: no

Per-service overrides, keyed by service key: <bag>.<service>, such as workflows.runtime. Barry applies them when it launches the service.

services:
  workflows.runtime:
    env:
      - BARRY_WORKFLOW_LABELS=model=local

services.<service-key>

• Type: object
• Required: no

One service’s overrides. env is the only key a service entry accepts.

services.<service-key>.env

• Type: list of string
• Required: no

KEY=VALUE literals that replace the values the service’s bag.yaml declares. Each key starts with an upper-case letter followed by upper-case letters, digits, or underscores, and appears once. An override may only replace a non-secret literal the service already declares. A new key or a key the service binds to a secret stops the service from starting. barry doctor --fix removes the retired BARRY_WORKFLOW_OWNERS and BARRY_WORKFLOW_WORKERS overrides.

secrets

• Type: map
• Required: no

Where the installation reads each secret it needs, keyed by the secret’s environment name. A name the installation asks for that has no entry here fails as undeclared. BARRY_SECRET defaults to {in: .env}. Run barry env audit to see which declared keys the installation can read.

secrets:
  MAILGUN_SIGNING_KEY:
    in: .env
  VAULT_BACKUP_SECRET:
    in: keychain
    item: barry-vault-backup

secrets.<NAME>

• Type: object
• Required: no

One secret reference. in picks the source, and the other keys depend on it.

secrets.<NAME>.in

• Type: string
• Required: yes
• Values: .env, keychain, vault

The source. .env reads the private environment file, keychain reads a macOS Keychain item, and vault reads an item from the vault that vault names.

secrets.<NAME>.key

• Type: string
• Required: no

With in: .env, the entry to read from the file when it differs from the secret’s name.

secrets.<NAME>.item

• Type: string
• Required: no

With in: keychain, the Keychain item’s service name. With in: vault, the vault item’s name. Required for both.

secrets.<NAME>.account

• Type: string
• Required: no

With in: keychain, the Keychain account to match.

secrets.<NAME>.field

• Type: string
• Required: no
• Values: username, password, notes, uri

With in: vault, which field of the item to read. Required with in: vault.

vault

• Type: string
• Required: no

The name of the vault that in: vault references read from. Barry opens it with the credentials filed in the Keychain under that name. A vault reference without this key fails to read.

vault: home

Examples

A worker that advertises a local model

Schedule and distribute work covers workers. After a change, restart the service with barry service restart workflows.runtime and check the result with barry workers status.

services:
  workflows.runtime:
    env:
      - BARRY_WORKFLOW_LABELS=model=local
      - BARRY_WORKFLOW_CAPACITY=2

Secrets from a file, the Keychain, and a vault

vault: home
secrets:
  BARRY_WORKFLOW_ACTOR_KEY:
    in: .env
  MAILGUN_SIGNING_KEY:
    in: .env
    key: MAILGUN_KEY
  VAULT_REGISTRATION_SECRET:
    in: keychain
    item: barry-vault-registration
    account: barry
  VAULT_BACKUP_SECRET:
    in: vault
    item: vault-backup
    field: password