Genroc allows you to pass environment variables through the config property.

Specifying config_schema

If you want to use config in your process, you first need to specify what values and types you require for the process.

This is done through config_schema, it takes a JSON Schema. It is similar to input_schema, however it only supports a flat object with primitive properties (as it's coming from env and nested properties would be awkward here).

nameUnique process identifier.: get-user-dataUnique process identifier.
input_schemaJSON Schema used to validate the input payload when starting a new instance.:
  typeThe value's JSON type, or a list of types it may take.: objectThe value's JSON type, or a list of types it may take.
  propertiesThe named members of an object, each a schema.:
    user_id: { typeThe value's JSON type, or a list of types it may take.: stringThe value's JSON type, or a list of types it may take. }
  requiredWhich properties must be present. A property not listed here may be absent, and reading it yields null.: [user_id]

config_schemaFlat object of primitive config variables, resolved from the server environment and read as config.<NAME>.:
  typeThe value's JSON type, or a list of types it may take.: objectThe value's JSON type, or a list of types it may take.
  propertiesThe named members of an object, each a schema.:
    server_origin:
      typeThe value's JSON type, or a list of types it may take.: stringThe value's JSON type, or a list of types it may take.
      defaultThe value used when this one is absent. Annotation only — it does not make a required property optional.: "http://localhost:8080"
    server_auth:
      typeThe value's JSON type, or a list of types it may take.: stringThe value's JSON type, or a list of types it may take.
      secretRedacts the value from logs. Only meaningful in a process config_schema.: trueRedacts the value from logs. Only meaningful in a process config_schema.
  requiredWhich properties must be present. A property not listed here may be absent, and reading it yields null.: [server_auth]

tasksOrdered list of execution tasks. Control advances linearly unless a switch case redirects.:
  - idTask identifier, unique within the definition.: load_userTask identifier, unique within the definition.
    actionDescribes the action to perform. Omit for switch-only (routing) tasks.:
      typeHTTP call. URL, method, headers and body are all expressions.: fetchHTTP call. URL, method, headers and body are all expressions.
      methodHTTP method, lowercase (e.g. get, post) or a template such as ${ input.method }. Required — the verb is never guessed.: getHTTP method, lowercase (e.g. get, post) or a template such as ${ input.method }. Required — the verb is never guessed.
      urlRequest URL. May contain ${ } interpolations, e.g. ${ config.server_url }/path.: "${configconfig → object{server_auth, server_origin}.server_originconfig.server_origin → string}/users/${inputinput → object{user_id}.user_idinput.user_id → string}"
      headersRequest headers, evaluating to an object of string values. Author it as a literal map (each value a ${ } template or a $: expression yielding a string), or as a single $: expression yielding the whole map.:
        Authorization: "Bearer ${configconfig → object{server_auth, server_origin}.server_authconfig.server_auth → string}"
    switchRequired. Routing: a shorthand ("next", "end", "$task-id") or an ordered list of cases.: endRequired. Routing: a shorthand ("next", "end", "$task-id") or an ordered list of cases.

Specifying the env

Values come from the environment of the genroc server (not genctl). Each property is read from a variable named after the process, or from a global one shared by all processes:

# only for get-user-data
GENROC_GET_USER_DATA_SERVER_AUTH=secret-token
# for every process with a server_origin property
GENROC_GLOBAL_SERVER_ORIGIN=https://api.example.com

Names are upper-cased, with - turned into _ and camelCase split (serverAuth reads SERVER_AUTH). Property names must be identifiers (letters, digits and _), and two properties that map to the same variable, like apiKey and api_key, are refused. The process variable wins over the global one, and an empty variable counts as unset. Without either, the default is used.

Values are converted to the declared type, so for a property declared as integer, GENROC_GLOBAL_RETRIES=3 arrives as a number and true/false as a boolean. A required value that's missing, or one that doesn't convert, is refused by genctl apply and when a process starts. Genroc reads the values again on every step and never stores them, so after you change one and restart the server, running processes use the new value too. If a value goes missing or stops converting, the process fails at its next step with engine.config.

Secrets

config_schema is also special, because you can mark a property as secret. This keeps the value out of the server's console output.

The value can however still leak into db logs accessible through genctl logs or into the process state.

Genroc replaces the exact value with *** wherever it appears in the console output. That works because expressions can't transform a value, so a secret only ever appears verbatim, like in Bearer <token>.