This is an automated email from the ASF dual-hosted git repository.
jamesbognar pushed a commit to branch docs
in repository https://gitbox.apache.org/repos/asf/juneau.git
The following commit(s) were added to refs/heads/docs by this push:
new 17f9e5a578 Add SecretStore/BeanStore credential snippet to
ScServerOverview (TODO-352 docs, recovered after a consolidation revert)
17f9e5a578 is described below
commit 17f9e5a57871ebcd0847211f25077c642caa19ff
Author: James Bognar <[email protected]>
AuthorDate: Thu Aug 13 13:56:29 2026 -0400
Add SecretStore/BeanStore credential snippet to ScServerOverview (TODO-352
docs, recovered after a consolidation revert)
---
pages/topics/18.01.ScServerOverview.md | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/pages/topics/18.01.ScServerOverview.md
b/pages/topics/18.01.ScServerOverview.md
index e697f7e0f8..f62bdf589c 100644
--- a/pages/topics/18.01.ScServerOverview.md
+++ b/pages/topics/18.01.ScServerOverview.md
@@ -150,6 +150,19 @@ new GitControl(pathLocal, gitRemote, "svc-account",
"hardcoded-token", false);
new GitControl(pathLocal, gitRemote, System.getenv("GIT_USERNAME"),
System.getenv("GIT_TOKEN"), false);
```
+For the strongest option, `GitControl` also has a constructor that resolves
the password/token from a
+pluggable
[`SecretStore`](/site/apidocs/org/apache/juneau/commons/secret/SecretStore.html):
the secret
+is looked up by key from the store resolved off a `BeanStore` (defaulting to
an in-memory store), held as
+a `char[]` rather than a `String`, and zeroed when the `GitControl` is closed.
Contribute an
+`EnvVarSecretStore`, an OS-keychain-backed store, or your own secrets-manager
adapter to keep the token
+out of both source and the checked-in `juneau-server-config.cfg`:
+
+```java
+// Safest — the token never appears as a literal or a String; it comes from
the contributed SecretStore.
+BeanStore beanStore = new BasicBeanStore().addBean(SecretStore.class, new
EnvVarSecretStore());
+new GitControl(pathLocal, gitRemote, "svc-account", "GIT_TOKEN", beanStore,
false);
+```
+
Never hardcode the `username`/`password` arguments in application code or in
the checked-in
`juneau-server-config.cfg`.
