No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

What’s the correct way to set a custom secrets provider without having to specify it in each stack’s manifest file? For example, the following (abbreviated) code:

```opts := []auto.LocalWorkspaceOption{
	...
	auto.SecretsProvider("awskms://..."),
}

stack, err := auto.UpsertStackLocalSource(ctx, "dev", "example", opts...)
if err != nil {
	log.Fatalf("Failed to load dev stack: %s\n", err)
}

_, err = stack.Refresh(ctx, optrefresh.ProgressStreams(os.Stdout))
if err != nil {
	log.Fatalf("Failed to refresh dev stack: %s\n", err)
}```
Results in the following error:

```[...] passphrase must be set with PULUMI_CONFIG_PASSPHRASE or PULUMI_CONFIG_PASSPHRASE_FILE environment variables [...]```

The answer is to pass a list of stack configs (with `auto.Stacks`) to the `opts` :man-facepalming:

```auto.Stacks(map[string]workspace.ProjectStack{
	"dev": {
		SecretsProvider: "awskms://...",
	},
}),```

The examples in <https://github.com/pulumi/automation-api-examples> actually cover this. I just missed it completely the first time I’ve looked at them