Fl4m3Ph03n1x
Background
I am doubling a little bit as a DevOps in the company where I am now. Recently I showed them the 12 factor app standard, that specifies you should not have your ENV, config and passwords inside your git repository together with your project - you should store them in a safe place instead.
Research
After some research we came across Vault however our team manager now thinks this is quite overkill and will soon become a monster.
Torus seemed a good alternative but the install page doesn’t even work, will be payed and it looks like it only runs for Node.
I also read this discussion but there is no definitive answer:
Questions
- What tools do you use to store your secrets?
- How do you your apps access them?
Where Next?
Trending in Discussions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Courses that'll move you from confusion to "Aha, now I get it!"
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #blog-post
- #elixir-ls
- #ai
- #elixirconf-us
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #hex
- #security
- #metaprogramming
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Practical resources that improve the lives of professional developers.
Bringing learning, work and compliance together since 1987.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 10- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
theangryangel
Currently smaller projects get deployed via anisble, secrets stored in ansible-vault (which is not the same as hashicorp vault!). These get written to a file as environment variables (which the systemd unit reads) and then that’s restricted via file system permissions (only root and application user can read the file). It’s not perfect, but does give you good starting point before heading to things like hashicorp Vault imho
jhosteny
Using ansible-vault is a good starting point, but if you have more than a few secrets, or need to generate things like certs for inter-service TLS, I’d recommend the investment in Hashicorp Vault. It really is invaluable, especially when coupled with something like envconsul.
If you stick with ansible-vault, I’ve found this to be helpful. Otherwise, it is easy to forget where vaulted vars are, and grep does you no good since they are encrypted at rest. Be sure to keep those refs close to where the actual vaulted vars are.
axelson
We run on Heroku so the 12 factor app approach has been working quite well
ryanwinchester
I don’t know why nobody ever seems to talk about it, but I use AWS Parameter Store.
Maybe I should write ablog post about it… `¯\(ツ)/¯
acrolink
But this can be used in the context of AWS only? Correct? Cannot be used for applications hosted at other cloud providers?
acrolink
Any updates on the topic, what is the best way to store secrets e.g. encryption keys for Elixir applications?
dimitarvp
Secrex — Secrex v0.4.0 is one option.
PaintingWithCode
Hush supports AWS, GCP and local env variables in a pluggable manner with the option to extend with custom providers too.
Adzz
On some projects I use GitHub - Adzz/gcp_secret_provider: A configuration provider that pulls secrets from GCPs Secret Manager on App boot. · GitHub which is a config provider that reads in secrets when the app starts.
Generally reading in the secret from Google Secret Manager (on GCP) when the app starts has been working well for me.
AndyL
Mozilla Sops is a nice tool. Encrypted secrets stored in YAML/JSON, keys in plaintext, values encrypted with one or more of AWS KMS, GCP KMS, Azure Key Vault, PGP. Encrypted datafile can be checked into the repo. Supports diffing.