Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What tools should I use to manage secrets from env files?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 83 posts

Re: Ask HN: What tools should I use to manage secrets from env files?

#31

Post by mtarnovan »

starwatch wrote: post #12

There are varying degrees to this but I'll focus on the early stage, low effort approaches I've found work. For an easy, slightly hacky version I've used git-crypt ( https://github.com/AGWA/git-crypt ) with tiny teams. You'll need to share the decryption key (e.g. via 1password shared vaults). As your need for security grows (but you're still not working with a giant team) you're better off using non-committed .env f…

> You'll need to share the decryption key (e.g. via 1password shared vaults).

Not really. It also supports keeping the symmetric decryption key encrypted with the GPG key of each added user (and handles this automatically). This is the default behavior.

What you're saying also works (quoting from readme, emphasis mine: "Alternatively, you can export a symmetric secret key, which you must securely convey to collaborators."), but feels worse from a security point of view.

Re: Ask HN: What tools should I use to manage secrets from env files?

#32

Post by barbazoo »

starwatch wrote: post #12

There are varying degrees to this but I'll focus on the early stage, low effort approaches I've found work. For an easy, slightly hacky version I've used git-crypt ( https://github.com/AGWA/git-crypt ) with tiny teams. You'll need to share the decryption key (e.g. via 1password shared vaults). As your need for security grows (but you're still not working with a giant team) you're better off using non-committed .env f…

So what you see when you look at the repo in Github et al is the encrypted file and locally you see the file unencrypted? That's neat, a bit like ansible-vault but less of a hassle for the user.

Re: Ask HN: What tools should I use to manage secrets from env files?

#33

Post by morkalork »

klodolph wrote: post #18

The place I work has a list of security guidelines that is, like, ten pages long and full of links to more detailed explanations. The exact advice depends on how you’re running your services. My starting advice, for cloud, is this: 1. Run in multiple, separate accounts. Don’t put everything in one account. This could be as simple as having a beta account for testing and a separate production account. 2. Use cloud-bas…

Cloud platforms for development really shine here. They've mostly solved all the problems for you, you just have to use their services. When running code locally, a service will use my account to access the dev secret manager and when running in the cloud it uses its own account to grab whatever it needs. At no point are secrets ever stored on my machine and I'm happy with that.

Re: Ask HN: What tools should I use to manage secrets from env files?

#34

Post by ali_piccioni »

In priority,

1. Stop using API keys. Configure SSO integration for developers and OIDC for automation. For example, this is very easy to setup with AWS.

2. If the above is not possible, then store credentials encrypted at rest. Decrypt them only at runtime. For example, SOPS to store encrypted credentials into the repo, then AWS KMS holds the decryption key. The SOPS Readme is very helpful.

Re: Ask HN: What tools should I use to manage secrets from env files?

#37

Post by proaralyst »

If you're already using systemd, you can use its built-in credentials manager[0] which uses a combination of an on-disk key and the TPM2 to encrypt secrets at rest.

Probably annoying if you have more than one machine though

[0]: https://man.archlinux.org/man/systemd-creds.1

Re: Ask HN: What tools should I use to manage secrets from env files?

#38

Post by abound »

mrl5 wrote: post #3

This is an interesting alternative to password manager, esp. if you want to version control your secrets https://github.com/getsops/sops

+1 for sops, I've used it across a dozen projects for keeping encrypted secrets directly in the repo. And for configuring infra with Terraform, the sops provider [1] is extra convenient.*

[1] https://github.com/carlpett/terraform-provider-sops

* With the standard caveat that you should audit any software you're planning on giving access to your most valuable secrets.

Re: Ask HN: What tools should I use to manage secrets from env files?

#39

Post by FooBarWidget »

ali_piccioni wrote: post #34

In priority, 1. Stop using API keys. Configure SSO integration for developers and OIDC for automation. For example, this is very easy to setup with AWS. 2. If the above is not possible, then store credentials encrypted at rest. Decrypt them only at runtime. For example, SOPS to store encrypted credentials into the repo, then AWS KMS holds the decryption key. The SOPS Readme is very helpful.

Let's say you're not on a major public cloud. Let's say you're on Hetzner How do you setup something like OIDC for workloads (workload identity)?
Post reply on HN