add envVars to example in deployApp()

[fh-mthomson]

Pulls out helpful example from #859 (comment)

This workflow and messaging was very clear and easy!

Additionally, it'd be helpful to mention rsconnect as an option to set env vars prior to deployment in the Posit Connect User Guide, which currently only references the Connect API.

[hadley]

Except that's not quite right either because running Sys.setenv() in the console will mean that your secret is now in the .Rhistory file 😞

[fh-mthomson]

Oof, right. I've updated the example to defer to an already-Renviron-defined variable, but probably a broader symptom of environment variables not being overly secure (vs e.g. a Keychain / Hashicorp Vault approach to secrets).

[hadley]

@fh-mthomson do you use hashicorp vault? I've been trying to find someone who uses it to help me learn if there's something we should do to make it easier to use from R.

[fh-mthomson]

I do! As a starting point, check out https://github.com/vimc/vaultr (h/t @richfitz for the great work!)

General feedback:

• Solid coverage of main Vault auth methods: token, user/pass, approle, LDAP
  • LDAP was included in recent 1.2.0 release (Implement ldap auth vimc/vaultr#46)
  • AWS auth has been stuck (support aws auth vimc/vaultr#28) - would be helpful for customers hosting Connect on EKS to be able to easily have a service user access Vault
• Given R6 interface, I found it hard to pick up / navigate function levels initially, but most flows, once established, can be wrapped: vault_client() -> login -> fetch secret from a given path

[richfitz]

Thanks for the tag Michael.

I've been trying to find someone who uses it to help me learn if there's something we should do to make it easier to use from R.

We've used vault from both R and python for the last ~7 years or so. If you want a chat/email/etc about what has worked well or not, feel free to drop me a line ([email protected])

[hadley]

Thanks @richfitz & @fh-mthomson!