Passwords

This page shows how to keep a password out of config.toml. Write the name of a command or of an environment variable instead, and Tilde fills in the value when it reads the file.

Ask a command: #{command}

[accounts.mail.store]
protocol = "imap"
username = "ada@example.org"
password = "#{pass show mail/work}"

Tilde runs the command and uses what it prints, without the last line break. The password manager keeps the secret, the file only names it.

• The command runs with /bin/sh -c (cmd.exe /c on Windows), with its standard input closed.
• It has 10 seconds. A command that fails or runs out of time is an error.
• The text ends at the first }. There is no nesting and no escape.
• Run the command in a terminal first, to see that it prints only the password.

Any program that prints the secret works, for example bw get password work-mail for Bitwarden. The command has no input, so unlock the vault before you start Tilde.

Read a variable: ${NAME}

[accounts.mail.transport]
protocol = "smtp"
username = "ada@example.org"
password = "${MAIL_PASSWORD}"

${NAME} is replaced by the environment variable NAME. The short form $NAME works too. A variable that is not set is left as written, so the password becomes the text ${MAIL_PASSWORD} and the login fails. A $ that is not followed by the name of a variable that is set stays as it is.

Where it works

• In every string of every section, not only in passwords: host = "${IMAP_HOST}" works, and so does encrypt_key = "#{...}" in the mail cache.
• You can mix the forms with plain text: "pre-#{printf 'a b'}-post" gives pre-a b-post.
• Tilde expands the values after it parses the file, so a value can never change the structure of the file.
• Each time a program reads the file it runs the commands, tcli check too.

When a command fails

In a section, tcli check stops at the first command that fails and shows one line with the position of the section:

┌────────────┬──────────────────┬───────────────────────────────┐
│ Where      │ Line             │ Problem                       │
├────────────┼──────────────────┼───────────────────────────────┤
│ [accounts] │ line 1, column 3 │ has a #{command} that failed. │
└────────────┴──────────────────┴───────────────────────────────┘

The message never holds what a command printed, because that may be a secret. tcli accounts never shows a credential either.

The file is yours and Tilde trusts it: a #{command} runs on your machine with your rights. Never put text from someone else into it.

Next: Mail accounts and Chat accounts.