First iteration:

• UI option to hide the value
• Server-side work to store this configuration for each env var

Second Iteration:

• Encryption of these variable values in storage

Care point - exporting of snapshots can include the env var values. Consider an option to include/exclude secrets?

I think that would complement this feature nicely

Had a discussion with @Steve-Mcl. The first iteration is pretty straightforward, but hidden environment variables will still be accessible to the Node-RED instance and snapshots.

If we’re focusing solely on hosted instances, encryption would be the appropriate approach for handling hidden environment variables. However, this wouldn’t work for remote instances since encrypted variables would need to be decrypted and re-encrypted each time credentials are regenerated via the device agent configuration. Additionally, the device agent would require some adjustments to accommodate this.

Steve suggested aligning the approach with how Node-RED handles credentials, and I tend to agree.

Steve suggested aligning the approach with how Node-RED handles credentials, and I tend to agree.

To be clear, I stated Node-RED has a mechanism for credentials - if desired (possible?), we might wish to utilise those since they remain encrypted on file.

The other points discussed were that snapshots (currently) store the env vars as Key/Value pairs & it is not currently possible to identify them as being "protected" thus not able to prevent them being downloaded from the snapshot download UI to reveal the env vars set as secret. Changing these would require the whole mechanism of snapshots (API, launcher, device agent) to have awareness of the enhanced format.

Thank you for clearing that out!