feat(secrets): add Doppler adapter

[mrbongiolo]

Doppler organizes secrets in "projects" (like my-awesome-project) and "configs" (like prod, stg, etc.), so the pattern project/config is required when defining the --account option.

Doppler does not have a concept of folders, so using --from option or FOLDER/SECRET pattern is not supported and will raise an error.

Initially, I was thinking of using the --from option to define the Doppler "config", but this would require a much larger change in how secrets are "folderized", so not allowing to use that option and parsing --account=project/config accordingly seemed like a better approach for now.

Site documentation PR: basecamp/kamal-site#134

[djmb]

Thanks @mrbongiolo!

It looks like there's no concept of an account for Doppler (or at least we the adapter doesn't need to know about it), so I think we should just make the account optional.

That could be a new requires_account? method on the abstract adapter that defaults to true.

The --from command is for specifying common prefixes for secrets, so I think we should allow it to be called like:

kamal secrets fetch --adapter doppler --from my-project/prd SECRET1 SECRET2 SECRET3

or:

kamal secrets fetch --adapter doppler my-project/prd/SECRET1 my-project/prd/SECRET2 my-project/prd/SECRET3

The second format would allow you to extract secrets from different projects or configs if really needed.

[djmb]

Oh, could we also implement the check_dependencies! method that was recently added. It should give a nice error message if doppler is not installed.

[mrbongiolo]

Thanks for the review @djmb!! I'll fix the points that you brought up and update the PR later today.

[mrbongiolo]

@djmb PR updated. Also added support for ENV["DOPPLER_TOKEN"], based on #1183

I will update the docs PR soon as well.

With the current approach, the doppler adapter doesn't support fetching secrets from multiple projects/configs when defining secrets like my-project/dev/SECRET1 other-project/prod/SECRET2. It will always use the project/config set for the first secret or the one using the --from option.