Skip to main content
Older versions of DBDock (pre-1.1) stored secrets directly in dbdock.config.json. migrate-config extracts them and moves them to .env, which is where they should be.

​
When to run it

If you have any of the following in dbdock.config.json:
  • database.password
  • storage.s3.accessKeyId / secretAccessKey
  • storage.cloudinary.apiKey / apiSecret
  • backup.encryption.secret
  • alerts.email.smtp.auth.user / pass
  • alerts.slack.webhookUrl
Run this command once — it’s a one-shot cleanup.

​
What it does

  1. Reads dbdock.config.json
  2. Extracts secrets to .env (appending, not overwriting existing vars)
  3. Rewrites dbdock.config.json without the secrets
  4. Updates .gitignore to ensure .env is excluded
  5. Prints a summary of what moved where

​
Sample output

​
Safe to run multiple times

If there are no secrets in the config, migrate-config exits cleanly with no changes. You can run it anytime to check.

​
After migration

Enable strict mode to prevent regression:
DBDock will then refuse to load any config file that still contains secrets.

​
See also

Security

Why secrets don’t belong in config files.

Configuration

Where every secret should live.