windows_registry_value

Experimental. One registry value under HKLM on a Windows host. The value’s type and data are compared with what’s there, without expanding environment names.

Experimental. Windows support is new, and this module may change between releases.

Use windows_registry_value to set one value under HKLM on a Windows host. A value of type expand_string is compared as stored, with %PATH% left as %PATH%, so it doesn’t show as changed on every plan.

Example usage

step "long_paths" {
  windows_registry_value {
    key  = "HKLM\\SYSTEM\\CurrentControlSet\\Control\\FileSystem"
    name = "LongPathsEnabled"
    type = "dword"
    data = "1"
  }
}

step "app_dirs" {
  windows_registry_value {
    key  = "HKLM\\SOFTWARE\\MyApp"
    name = "Folders"
    type = "multi_string"
    data = "C:\\app\nC:\\data"
  }
}

A secret stays out of the plan and state:

step "api_token" {
  windows_registry_value {
    key     = "HKLM\\SOFTWARE\\MyApp"
    name    = "Token"
    type    = "string"
    data_wo = "use an ephemeral variable here"
  }
}

Arguments

Name	Type	Required	Description
data	string	One of	The data: a decimal number for dword and qword, hex for binary, one value per line for multi_string. Set this or data_wo.
data_wo	string	One of	Like data, but kept out of state: state records only data_hmac. Use it for secrets.
key	string	Yes	Key under HKLM, such as HKLM\SOFTWARE\App. Created if it’s missing.
name	string	No	Value name. Leave unset for the key’s default value.
on_remove	string	No	What happens on the host when this resource is removed: “forget” (default) leaves the value, “delete” removes the value and leaves the key.
type	string	Yes	“string”, “expand_string”, “multi_string”, “dword”, “qword” or “binary”.

Read-only attributes

Conn3x sets these; reference them as conn3x_windows_registry_value.<circuit>__<step>["<host>"].<name>.

Name	Type	Description
data_hmac	string	HMAC-SHA256 of data_wo, keyed by CONN3X_HMAC_KEY or ~/.config/conn3x/hmac.key. Null when data is used.
in_sync	bool	Whether the value matched at the last refresh. A secret’s change shows here only.
revision	string	Changes each time Conn3x changes this on the host. Handlers watch it.

A step lowers to the conn3x_windows_registry_value resource, one instance per host, and connects with its circuit’s ssh block.

How it works

Data. dword and qword take a decimal number, binary takes hex such as 0aff, and multi_string takes one value per line.

Secrets. data_wo travels on stdin. A refresh asks the host for the SHA-256 of the value and compares a keyed hash with state, so drift still shows and the secret doesn’t come back. Registry permissions decide who else can read it: HKLM values are readable by every user unless the key says otherwise, so a secret here needs a key you’ve locked down.

Keys. A missing key is created. Only HKLM is supported, in the 64-bit view.

Removal

By default, deleting a windows_registry_value step leaves the value. With on_remove = "delete" it deletes the value and leaves the key.