61–70 of 83 posts
Earlier quoted context omitted.
So what you see when you look at the repo in Github et al is the encrypted file and locally you see the file unencrypted? That's neat, a bit like ansible-vault but less of a hassle for the user.
yes, exactly right. it's an encrypted binary on github, but locally (provided you've decrypted it) it'll be unencrypted. If you edit the file locally, it automatically encrypts. It's a neat bit of tech.
Does your team already use a password manager? (If not, they probably should) Some of them have secrets management built-in too, like: - https://1password.com/developers/secrets-management - https://bitwarden.com/products/secrets-manager/
I tried to get my head around the 1Password implementation of this, but as far as I could work out, every single secret is stored as an individual item in 1Password and the 1Password app makes no accommodations for the differences between a server secret and a login. We have maybe 100 projects, with multiple environments for each, and multiple secrets in each environment - managing this in 1Password looks like it wou…
So on a dev machine it could use the dev vault for your project, but when you deploy it could use the prod vault.
Within vaults you can name and organise how you like, you’re not limited to usernames and passwords. You can have arbitrarily named fields, whole text blocks, or files.
If you don’t, .env files with a proper .gitignore
Or AWS secrets manager, GitHub secrets, Azure KeyVault and inject them.
If you run on something like Azure, use Managed Identities. Passwords shouldn’t be used period. API keys should be securely injected in a pipeline from a vault.
Earlier quoted context omitted.
> You'll need to share the decryption key (e.g. via 1password shared vaults). Not really. It also supports keeping the symmetric decryption key encrypted with the GPG key of each added user (and handles this automatically). This is the default behavior. What you're saying also works (quoting from readme, emphasis mine: " Alternatively , you can export a symmetric secret key, which you must securely convey to collabor…
True on all counts. I never got the GPG approach working - though admittedly I didn't put too much effort into figuring it out.
New account, mentions going with Doppler, a few "use doppler" comments as well. Sketchy as fuck
If you develop in .Net, User Secrets. Best idea ever. If you don’t, .env files with a proper .gitignore Or AWS secrets manager, GitHub secrets, Azure KeyVault and inject them. If you run on something like Azure, use Managed Identities. Passwords shouldn’t be used period. API keys should be securely injected in a pipeline from a vault.