Telegraf SecretStore to connect to an OPCUA Server

.env

OPCUA_USER=user1
OPCUA_PASSWORD=supersecretstuff

docker-compose.yml

services:
  telegraf:
    image: telegraf:latest
    container_name: telegraf-opcua
    user: "1000"
    network_mode: host
    volumes:
      - ./telegraf.toml:/etc/telegraf/telegraf.conf:ro
    secrets:
      - opcua_user
      - opcua_password
secrets:
  # use the new feature of loading an environment variable in docker to a dedicate secret under `/run/secrets/<secret_name>`
  opcua_user:
    environment: OPCUA_USER
  opcua_password:
    environment: OPCUA_PASSWORD

telegraf.toml

[agent]
    interval = "20s"
    round_interval = true
    metric_batch_size = 1000
    metric_buffer_limit = 10000
    collection_jitter = "0s"
    flush_interval = "10s"
    flush_jitter = "0s"
    precision = ""
    debug = true
    quiet = false
    hostname = ""
    omit_hostname = true

[[secretstore.jose]]
  id = "ot_secretstore"
  path = "/run/secrets"

#############################################################
#                   OUTPUT PLUGINS                          #
#############################################################
[[outputs.file]]
  data_format = "json"

[[inputs.opcua]]
  ## Metric name
  name = "testopcua"
  #
  ## OPC UA Endpoint URL
  endpoint = "opc.tcp://192.168.10.101:4840"
  #
  ## Maximum time allowed to establish a connect to the endpoint.
  connect_timeout = "60s"
  #
  ## Maximum time allowed for a request over the established connection.
  request_timeout = "60s"
  #
  ## Security policy, one of "None", "Basic128Rsa15", "Basic256",
  ## "Basic256Sha256", or "auto"
  security_policy = "None"
  #
  ## Security mode, one of "None", "Sign", "SignAndEncrypt", or "auto"
  security_mode = "None"
  
  ## Authentication Method, one of "Certificate", "UserName", or "Anonymous".  To
  ## authenticate using a specific ID, select 'Certificate' or 'UserName'
  auth_method = "UserName"
  #
  ## Username. Required for auth_method = "UserName"
  # username = "OpcUserLevel2"
  username = "@{ot_secretstore:opcua_user}"
  #
  ## Password. Required for auth_method = "UserName"
  password = "@{ot_secretstore:opcua_password}"
  #
  ## Option to select the metric timestamp to use. Valid options are:
  ##     "gather" -- uses the time of receiving the data in telegraf
  ##     "server" -- uses the timestamp provided by the server
  ##     "source" -- uses the timestamp provided by the source
  timestamp = "source"

  nodes = [ {name="test", namespace="2", identifier_type="s", identifier="IX_SSC_LightBarrierOutsource_I4"}  ]