KeePass schemas¶

Source of truth: pkg/secrets/bootstrap_reference.go and each plugin's *_config.go / Configure.

Host mapping (entryToSettings): Title→name, URL→url+host, UserName→username, Password→password, Notes→notes, plus all custom attributes.

Path pattern: <plugin>/<environment>/<instance>

docker¶

Field	Meaning
URL	Docker host (`unix:///var/run/docker.sock`, `tcp://host:2376`)
`cert_path`	TLS certificates directory
`tls`	`"true"` enable TLS
`tls_verify`	`"true"` verify TLS
`tags`	comma-separated tags

redis¶

Field	Meaning
URL	host
UserName	ACL username (Redis 6+, optional)
Password	auth (optional)
`port`	default `6379`
`database`	default `0`
`tags`	tags

kafka¶

Field	Meaning
URL	bootstrap servers (comma-separated)
UserName / Password	SASL (optional)
`sasl_mechanism`	e.g. `PLAIN`, `SCRAM-SHA-256`
`enable_sasl`	`"true"`
`enable_ssl`	`"true"`
`ssl_ca_cert` / `ssl_cert` / `ssl_key`	SSL paths
`tags`	tags

rabbitmq¶

Field	Meaning
URL	host
UserName / Password	credentials
`amqp_port`	default `5672`
`mgmt_port`	default `15672` (management API)
`vhost`	default `/`
`use_tls`	`"true"` / `"false"`
`tags`	tags

Note

Legacy custom attr port is accepted only as a fallback for mgmt_port when mgmt_port is empty.

postgres¶

Field	Meaning
URL	host
UserName / Password	credentials
`port`	default `5432`
`database`	default `postgres`
`sslmode`	default `disable` (e.g. `require`, `verify-full`)
`tags`	tags

ssh¶

Field	Meaning
URL	host or IP
UserName	login
Password	if password auth
`port`	default `22`
`auth_method`	`key`, `password`, or `auto`
`private_key`	PEM content
`key_path`	path to key file (e.g. `~/.ssh/id_ed25519`)
`passphrase`	key passphrase
`proxy_command`	ProxyCommand
`jump_host`	bastion `user@host:port`
`jump_key` / `jump_key_path`	jump host key
`fingerprint`	expected host key fingerprint
`startup_cmd`	command after connect
`keep_alive`	seconds (default `30`)
`tags`	tags
`env_*`	environment variables (e.g. `env_TERM`)

argocd¶

Field	Meaning
URL	Argo CD server
UserName / Password	user/pass auth
`auth_token`	bearer token (alternative to user/pass)
`insecure`	`"true"` skip TLS verify
`kubeconfig`	inline kubeconfig YAML (RBAC via k8s API)
`kubeconfig_path`	path to kubeconfig
`namespace`	Argo CD namespace (default `argocd`)
`tags`	tags

k8suser¶

Field	Meaning
URL	API server (optional if kubeconfig set)
Password	bearer token (if used)
`kubeconfig`	path to kubeconfig
`context`	kubectl context
`ca_cert`	CA certificate path
`tags`	tags

k8sportforward¶

Field	Meaning
`kubeconfig`	path or inline YAML
`kubeconfig_path`	alias for path
`kubeconfig_data`	alternate inline data (Configure)
`context`	context name
`namespace`	default namespace filter
URL / UserName / Password	unused for most clusters

awsCosts¶

Field	Meaning
URL	AWS region (e.g. `us-east-1`) — not an HTTP endpoint
UserName	access key ID
Password	secret access key
`role_arn`	IAM role ARN for assume-role
`tags`	tags

Configure also accepts region from custom region if set; otherwise uses URL/host.

s3¶

Field	Meaning
URL	S3-compatible endpoint
UserName	access key ID
Password	secret access key
`region`	AWS region
`role_arn`	assume-role ARN
`tags`	tags

git¶

Field	Meaning
URL	remote URL (optional)
UserName / Password	auth token (optional)
`path`	local repository path (required for local ops)
`tags`	tags

github¶

Field	Meaning
Password	personal access token (required)
UserName	org name when `type=org`
URL	API base (empty = `https://api.github.com`)
`type`	`user` (default) or `org`

bunnydns¶

Field	Meaning
Password	Bunny AccessKey (also accepts custom `access_key` / `api_key`)
URL	API base (default `https://api.bunny.net`)

sysprocess¶

No KeePass entry. Local process monitor only.