Add Env Var Interpolation Support

[Lailanater]

Given the following fnox.toml file the environment variable DATABASE_URL will be partially resolved

[secrets]
POSTGRES_PASSWORD= { provider = "op", value = "Database/password" }
POSTGRES_USER= { provider = "op", value = "Database/username" }
POSTGRES_PORT= { provider = "op", value = "Database/port" }
POSTGRES_DB= { provider = "op", value = "Database/database" }
POSTGRES_HOST= { provider = "op", value = "Database/host" }
DATABASE_URL= { default = "postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}" }

With an output like this:

The DATABASE_URL would only include POSTGRES_USER and POSTGRES_DB since they were resolved before DATABASE_URL

[nartamonov]

Another example that abstracts over different container registries on dev and prod environments:

[secrets]
CI_BOT_TOKEN = { provider = "age", value = "..." }

[profiles.dev.secrets]
CONTAINER_REGISTRY = { default = "registry.gitlab.com" }
CONTAINER_REGISTRY_USER = { default = "ci" }
CONTAINER_REGISTRY_PASSWORD = { default = "$CI_BOT_TOKEN" } # <-- Doesn't work currently

[profiles.production.secrets]
CONTAINER_REGISTRY = { default = "registry.company.ru:1234" }
CONTAINER_REGISTRY_USER = { default = "prod" }
CONTAINER_REGISTRY_PASSWORD = { provider = "age", value="..." }

[kclejeune]

would really love to just see tera template support here similar to mise env variables!

[fakhrulhilal]

Second this. This is very common practice. Sometimes we override username, and password only with the profile. But the URL builder is same for all profiles.

[jdx]

Implemented this in PR #549: #549

The PR adds ${VAR} interpolation for secret default values and wires those references into the existing resolver dependency ordering, so composed values like DATABASE_URL resolve independently of TOML key order. It also covers profile overrides, provider-backed referenced secrets, cycles, undefined references, empty ${} references, and single-secret fnox get resolution without validating unrelated profile secrets.

This comment was AI-generated.