@cfxlabsinc/b2b-services
    Preparing search index...

    Class DopplerProject

    Owns a package's Doppler project outright — the project, its environments, its Secrets Manager sync, and the secrets written into it. The Doppler analogue of AuroraWorkloadUser / ValkeyWorkloadUser.

    const project = new DopplerProject("cfx-deposit-api", {
      provider: dopplerProvider,
    });
    project.putSecret("TEMPORAL_API_KEY", token);
    project.putSecret("TEMPORAL_ADDRESS", address, { visibility: "unmasked" });

    One Doppler project per service, owned by that service's Pulumi program, and ONE config per instance — the stack's. A stack is an environment here, so cfx-deposit-api/dev is written by the dev stack and cfx-deposit-api/prod by the prod stack, each with its own values. There is no environment argument because there is no correct value other than pulumi.getStack().

    NOTE the asymmetry between the two resources this declares. The environment is per-stack and never contended: dev owns dev, prod owns prod. The PROJECT is workplace-scoped and shared, so both stacks declare the same object while holding separate state — exactly one stack can create it, and the other must adopt it with a one-off pulumi import, or its apply dies with Doppler's 400 "Project name already exists in this workplace." That is why every service's project is imported into BOTH stacks, and why a brand-new service needs one import (in whichever environment deploys second) rather than none.

    There is NO per-service identity and NO per-service GitHub config: one doppler-<env> identity (matched by a wildcard sub + ref: refs/heads/main) authenticates every deploy. Adding a service is just another instance of this component — no Doppler-side setup, no manual grant.

    That identity is workplace-admin-scoped, so it can reach every project and every config, dev and prod alike. The environment split is enforced by WHICH identity CI hands a job — doppler-dev is matched on sub: …:environment:*-dev and doppler-prod on *-prod — not by Doppler permissions. That is a deliberate trade: Doppler ties access_all_environments to the admin role and refuses to scope it down, and admin is the floor for creating a project, creating its environments, or writing its description.

    Hierarchy

    • ComponentResource
      • DopplerProject
    Index
    constructor
    project projectName secretsManagerPath urn
    getData getProvider initialize putSecret registerOutputs isInstance
    project: Project
    projectName: string

    The project slug (the component name).

    secretsManagerPath: Input<string>

    The AWS Secrets Manager path this project's sync writes to.

    Exposed because the path has two ends and they must agree: the sync WRITES it, and the service's env.ts (or getSecretContentsAsEcsSecretArgs) READS it. Three programs had hardcoded the derived string on the read side — "/cfx/internal-dashboard/doppler" — which is a second, independent computation of the rule defaultSecretsManagerPath exists to keep singular. Read it off the project instead.

    urn: Output<string>

    The stable logical URN used to distinctly address a resource, both before and after deployments.

    • Retrieves the data produces by initialize. The data is immediately available in a derived class's constructor after the super(...) call to ComponentResource.

      Returns Promise<any>

    • Returns the provider for the given module member, if one exists.

      Parameters

      • moduleMember: string

      Returns ProviderResource | undefined

    • Can be overridden by a subclass to asynchronously initialize data for this component automatically when constructed. The data will be available immediately for subclass constructors to use. To access the data use getData.

      Parameters

      • args: Inputs
      • Optionalopts: ComponentResourceOptions
      • Optionalname: string
      • Optionaltype: string

      Returns Promise<any>

    • Write a secret into this stack's config. Masked by default; pass visibility: "unmasked" for non-sensitive values like an address or namespace id.

      The value is whatever the calling stack computed, so dev and prod hold genuinely different values — each stack writes only its own config.

      Parameters

      • secretName: string
      • value: Input<string>
      • Optionalopts: { visibility?: string }

      Returns void

    • Registers synthetic outputs that a component has initialized, usually by allocating other child sub-resources and propagating their resulting property values.

      Component resources can call this at the end of their constructor to indicate that they are done creating child resources. This is not strictly necessary as this will automatically be called after the initialize method completes.

      Parameters

      • Optionaloutputs: Inputs | Promise<Inputs> | Output<Inputs>

      Returns void

    • Returns true if the given object is a CustomResource. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

      Parameters

      • obj: any

      Returns obj is ComponentResource<any>

    Settings
    Member Visibility

    On This Page
    Constructors
    Properties
    Methods