extract bootstrap secrets to env vars

[nicolasgnr]

Summary

This PR adds support for resolving sensitive configuration values from environment variables instead of requiring them to be stored in the TOML configuration file bootstrap.toml.

Specifically, the database URL and keystore password can now be provided via environment variables, making it easier to manage secrets securely. If both a value and its corresponding environment variable are configured, the value defined in the configuration file takes precedence.

Changes

• Added GetURL() to DBConfig to resolve the database URL from either:

  • URL (highest precedence)
  • URLEnvVar

• Added GetPassword() to KeystoreConfig to resolve the keystore password from either:

  • Password (highest precedence)
  • PasswordEnvVar

• Refactored validation to use the new getter methods, centralizing configuration resolution and removing duplicated logic.

• Updated the bootstrap flow to use the new resolution methods.

• Added comprehensive tests covering:

  • Direct configuration values
  • Configuration precedence over environment variables
  • Environment variable fallback
  • Missing environment variables
  • Missing configuration from both sources

Motivation

Secrets such as database credentials and keystore passwords should not be committed to or stored in plaintext configuration files. This change allows deployments to inject these values securely through environment variables while maintaining backward compatibility with existing configurations.

This allow as to move from

[jd]
server_wsrpc_url = "wsrpc-job-distributor.sh"
server_csa_public_key = "41dcc9f2d7....."

[keystore]
password = "sensitive info"

[db]
url = "sensitive info"
[server]
listen_port = 8080

to

[jd]
server_wsrpc_url = "wsrpc-job-distributor.sh"
server_csa_public_key = "41dcc9f2d7....."

[keystore]
password_env_var = "KEYSTORE_PASSOWORD_ENV_VAR"

[db]
url_env_var = "CL_DATABASE_URL"
        
[server]
listen_port = 8080

This change is fully backward compatible. Existing configurations that specify password and url directly continue to work unchanged.

In the future, once everything have migrated, we can remove the plaintext secret fields from the configuration, making environment variables the only supported mechanism for supplying sensitive values.

[github-actions]

👋 nicolasgnr, thanks for creating this pull request!

To help reviewers, please consider creating future PRs as drafts first. This allows you to self-review and make any final changes before notifying the team.

Once you're ready, you can mark it as "Ready for review" to request feedback. Thanks!

[Copilot]

Pull request overview

Adds support in the bootstrapper configuration layer to resolve sensitive values (DB URL, keystore password) from environment variables with explicit precedence for values set directly in bootstrap.toml.

Changes:

• Introduced KeystoreConfig.GetPassword() and DBConfig.GetURL() to centralize precedence/lookup logic (direct value > env var).
• Refactored validation to use the new getters and updated bootstrap startup to consume resolved values.
• Added unit tests covering direct values, precedence, env var fallback, and error cases.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 8 comments.

File	Description
bootstrap/config.go	Adds env-var-backed getters for keystore password and DB URL; updates validation to call getters.
bootstrap/config_test.go	Adds tests for the new getters and extends validation tests (though additional env-var validation cases are still needed).
bootstrap/bootstrap.go	Updates JD lifecycle startup to resolve DB URL and keystore password via the new getter methods.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[makramkd]

Secrets such as database credentials and keystore passwords should not be committed to or stored in plaintext configuration files. This change allows deployments to inject these values securely through environment variables while maintaining backward compatibility with existing configurations.

I disagree w/ the motivation behind this PR. The chainlink node has been using a secrets.toml since v2 (4+ years in production at this point). Its pretty straightforward to set up a templated TOML file that uses secrets for its values for k8s deployments, I believe Chainlink node operators have been doing it for years now.

The bootstrap.toml config will never be sent by Chainlink, its entirely node operator provided.

This change also violates the "stay consistent w/ Chainlink where reasonable" principle, creating more complexity in configuration isn't the right path forward, keeping things simple and consistent where applicable is better.

[huangzhen1997]

Secrets such as database credentials and keystore passwords should not be committed to or stored in plaintext configuration files. This change allows deployments to inject these values securely through environment variables while maintaining backward compatibility with existing configurations.

I disagree w/ the motivation behind this PR. The chainlink node has been using a secrets.toml since v2 (4+ years in production at this point). Its pretty straightforward to set up a templated TOML file that uses secrets for its values for k8s deployments, I believe Chainlink node operators have been doing it for years now.

The bootstrap.toml config will never be sent by Chainlink, its entirely node operator provided.

This change also violates the "stay consistent w/ Chainlink where reasonable" principle, creating more complexity in configuration isn't the right path forward, keeping things simple and consistent where applicable is better.

This is backwards compatible, they can still provides plaintext secret if they want, but we should offer option for user who don't want to do it. This aligns with how Aggregator provides secrets with aggregator config. We just want to follow the same pattern, to me this seems more secure otherwise we won't do it for our internal production deployment.

[github-actions]

Code coverage report:

Package	main	nm/extract-bootstrap-secrets-to-env-vars	Diff
github.com/smartcontractkit/chainlink-ccv/aggregator	49.53%	49.54%	+0.01%
github.com/smartcontractkit/chainlink-ccv/bootstrap	45.63%	55.97%	+10.34% 🎉
github.com/smartcontractkit/chainlink-ccv/cli	65.13%	65.13%	+0.00%
github.com/smartcontractkit/chainlink-ccv/cmd	13.55%	13.55%	+0.00%
github.com/smartcontractkit/chainlink-ccv/common	51.82%	51.82%	+0.00%
github.com/smartcontractkit/chainlink-ccv/executor	45.71%	45.71%	+0.00%
github.com/smartcontractkit/chainlink-ccv/indexer	35.60%	35.55%	-0.05%
github.com/smartcontractkit/chainlink-ccv/integration	46.16%	46.25%	+0.09%
github.com/smartcontractkit/chainlink-ccv/pkg	100.00%	100.00%	+0.00%
github.com/smartcontractkit/chainlink-ccv/pricer	0.00%	0.00%	+0.00%
github.com/smartcontractkit/chainlink-ccv/protocol	63.06%	63.06%	+0.00%
github.com/smartcontractkit/chainlink-ccv/verifier	35.18%	35.17%	-0.01%
Total	46.60%	46.80%	+0.20%