🔄 Sync updated workspace manifests

.vitepress/data/dependencies.yaml

@@ -715,7 +715,7 @@ dependencies:
     home: https://github.com/kloudkit/ws-cli
     license: MIT
     package: github.com/kloudkit/ws-cli
-    version: 0.0.36
+    version: 0.0.43
 
   yamllint:
     cmd: yamllint --version

.vitepress/data/env.reference.yaml

@@ -292,6 +292,58 @@ envs:
         description: Combined log file for `stdout` and `stderr`.
         since: 0.0.21
 
+  secrets:
+    properties:
+      master_key:
+        type: string
+        default: null
+        example: dGhpcyBpcyBhIHNlY3JldCBrZXkgZXhhbXBsZQ==
+        since: 0.1.1
+        description: Master encryption key for secrets vault.
+        longDescription: |
+          Used to encrypt and decrypt secrets in the vault.
+          Can be provided as:
+
+          - A base64-encoded string.
+          - A plaintext string.
+
+          **Master key lookup precedence:**
+
+          1. CLI `--master` flag *(if provided)*.
+          2. `WS_SECRETS_MASTER_KEY` *(this variable)*.
+          3. `WS_SECRETS_MASTER_KEY_FILE`.
+          4. `/etc/workspace/master.key` *(default path)*.
+
+      master_key_file:
+        type: string
+        default: /etc/workspace/master.key
+        example: /etc/workspace/custom-master.key
+        since: 0.1.1
+        description: Path to file containing the master encryption key.
+        longDescription: |
+          Used to encrypt and decrypt secrets in the vault.
+          Can be provided as:
+
+          - A base64-encoded string.
+          - A plaintext string.
+
+          **Master key lookup precedence:*
+
+          1. CLI `--master` flag *(if provided)*.
+          2. `WS_SECRETS_MASTER_KEY`.
+          3. `WS_SECRETS_MASTER_KEY_FILE` *(this variable)*.
+          4. `/etc/workspace/master.key` *(default path)*.
+
+      vault:
+        type: string
+        default: null
+        example: /workspace/.vault.yaml
+        since: 0.1.1
+        description: Path to the secrets vault file.
+        longDescription: |
+          A YAML file containing encrypted secrets that can be decrypted and
+          deployed to various destinations during startup.
+
   server:
     properties:
       port: