runr_env_var (Resource)

One environment variable of a project. Either kind reaches the running deployment with the next deploy: redeploy (runr_deployment.triggers) to apply a change.

• Plain variables (secret = false) are part of the project config; each change saves a new project version.
• Secret variables (secret = true) are stored write-only through the project's secrets API: RunR lists their names, never their values, and they never appear in a version. Terraform keeps the value it set (value, sensitive) and notices when the variable is removed outside Terraform. With value_wo (Terraform 1.11 and later) the value is not stored in the state either; change value_wo_version to write a new value.

A name is plain or secret, never both; switching secret recreates the variable.

Example Usage#

resource "runr_env_var" "log_level" {
  project_id = runr_project.api.id
  name       = "LOG_LEVEL"
  value      = "info"
}

# A secret variable: stored write-only, listed by name only. Terraform keeps the value it set
# (sensitive) and recreates the variable when it is removed outside Terraform.
resource "runr_env_var" "database_url" {
  project_id = runr_project.api.id
  name       = "DATABASE_URL"
  value      = var.database_url
  secret     = true
}

# Terraform 1.11 and later: value_wo never reaches the state; bump value_wo_version to write a
# new value (for example after a rotation).
resource "runr_env_var" "signing_key" {
  project_id       = runr_project.api.id
  name             = "SIGNING_KEY"
  value_wo         = var.signing_key
  value_wo_version = "2026-10"
  secret           = true
}

variable "database_url" {
  type      = string
  sensitive = true
}

variable "signing_key" {
  type      = string
  sensitive = true
  ephemeral = true
}

Schema#

Required#

• name (String) Variable name.
• project_id (String) Project id.

Optional#

NOTE: Write-only arguments are supported in Terraform 1.11 and later.

• secret (Boolean) Store the value as a write-only secret variable. Changing it recreates the variable.
• value (String, Sensitive) Value (sensitive). One of value and value_wo is required.
• value_wo (String, Sensitive, Write-only) Value of a secret variable that Terraform never stores (write-only attribute, Terraform 1.11 and later; needs secret = true). Terraform cannot compare it, so change value_wo_version to write a new value.
• value_wo_version (String) Any string; a change writes value_wo again (for example a rotation date).

Read-Only#

• id (String) <project_id>/<name>.

Import#

Import is supported using the following syntax:

The terraform import command can be used, for example:

# <project name or id>/<variable name>
terraform import runr_env_var.log_level orders-api/LOG_LEVEL

# A secret variable is imported with secret = true and without its value (RunR never returns
# it); the next apply writes the value of the configuration.
terraform import runr_env_var.database_url orders-api/DATABASE_URL