Fl4m3Ph03n1x
How do you store your secrets?
Background
I am doubling a little bit as a DevOps in the company where I am now. Recently I showed them the 12 factor app standard, that specifies you should not have your ENV, config and passwords inside your git repository together with your project - you should store them in a safe place instead.
Research
After some research we came across Vault however our team manager now thinks this is quite overkill and will soon become a monster.
Torus seemed a good alternative but the install page doesn’t even work, will be payed and it looks like it only runs for Node.
I also read this discussion but there is no definitive answer:
Questions
- What tools do you use to store your secrets?
- How do you your apps access them?
First Post!
theangryangel
Currently smaller projects get deployed via anisble, secrets stored in ansible-vault (which is not the same as hashicorp vault!). These get written to a file as environment variables (which the systemd unit reads) and then that’s restricted via file system permissions (only root and application user can read the file). It’s not perfect, but does give you good starting point before heading to things like hashicorp Vault imho
Most Liked
PaintingWithCode
AndyL
Mozilla Sops is a nice tool. Encrypted secrets stored in YAML/JSON, keys in plaintext, values encrypted with one or more of AWS KMS, GCP KMS, Azure Key Vault, PGP. Encrypted datafile can be checked into the repo. Supports diffing.
jhosteny
Using ansible-vault is a good starting point, but if you have more than a few secrets, or need to generate things like certs for inter-service TLS, I’d recommend the investment in Hashicorp Vault. It really is invaluable, especially when coupled with something like envconsul.
If you stick with ansible-vault, I’ve found this to be helpful. Otherwise, it is easy to forget where vaulted vars are, and grep does you no good since they are encrypted at rest. Be sure to keep those refs close to where the actual vaulted vars are.
Last Post!
iqra
Secret managements refers the tools and method for managing digital authentication secrets including passwords, keys and tokens.
Popular in Discussions
Other popular topics
Chat & Discussions>Discussions
Latest on Elixir Forum
Sponsor Spotlight
We build reliable cloud platforms for business-critical systems.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #websockets
- #supervisor
- #elixirconf-us
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #metaprogramming
- #security
- #hex
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Develop your skills with books, videos, and courses.
Producing high quality Elixir screencasts since 2017.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"