Allow registry username to be a reference to secret

README.md

@@ -150,10 +150,14 @@ The default registry is Docker Hub, but you can change it using `registry/server
 ```yaml
 registry:
   server: registry.digitalocean.com
-  username: registry-user-name
+  username:  
-  password: <%= ENV.fetch("MRSK_REGISTRY_PASSWORD") %>
+    - DOCKER_REGISTRY_TOKEN
+  password: 
+    - DOCKER_REGISTRY_TOKEN
 ```
 
+A reference to secret `DOCKER_REGISTRY_TOKEN` will look for `ENV["DOCKER_REGISTRY_TOKEN"]` on the machine running MRSK.
+
 ### Using a different SSH user than root
 
 The default SSH user is root, but you can change it using `ssh/user`:

lib/mrsk/commands/registry.rb

@@ -2,7 +2,7 @@ class Mrsk::Commands::Registry < Mrsk::Commands::Base
   delegate :registry, to: :config
 
   def login
-    docker :login, registry["server"], "-u", redact(registry["username"]), "-p", redact(lookup_password)
+    docker :login, registry["server"], "-u", redact_credentials("username"), "-p", redact_credentials("password")
   end
 
   def logout
@@ -10,11 +10,13 @@ class Mrsk::Commands::Registry < Mrsk::Commands::Base
   end
 
   private
-    def lookup_password
+    def redact_credentials(key)
-      if registry["password"].is_a?(Array)
+      value = if registry[key].is_a?(Array)
-        ENV.fetch(registry["password"].first).dup
+          ENV.fetch(registry[key].first).dup
-      else
+        else
-        registry["password"]
+          registry[key]
-      end
+        end
+
+      redact(value)
     end
 end