Hello. I'm hoping to use dagster-postgres for persistence, but I would like to keep the password out of dagster.yml. Is there a way to inject it at runtime?

you can use env vars which are filled by whichever secrets manager you happen to be using

Is there another option? This requires additional setup on each host.

not really another option that I can think of, although I think secrets setup shouldn’t be too bad, depending on what system you’re using? Do you have an anolog in another system of something you’d be expecting?

We have a uniform setup on each host that connects to a secrets manager. The code pulls down whatever secrets it needs this way, but only at runtime. This way the host is always the same save for the deployed code, and the secrets never end up in source control.

Why not encapsulate that in a wrapper script?

That's not very tidy.