Perhaps someone could help me with this.
I have repo Y which has sensitive secrets/config information, this is encrypted before being pushed to git.
Next up is the server/process that needs to decrypt this information.
How would I go about automating the decryption of these files securely?
So far I'm storing the encryption/decryption key in another repo, but that feels wrong. Passphrases would require manual intervention (and if automating the problem remains).
I suppose a hardware device attached the servers meant to decrypt the information is plausible, but I'm thinking about using the cloud.
So, steps I have in mind:
* automated server creation in aws * provisioning git pulls the repo with encrypted files * automatic decryption before reloading service. * ...if automated, I need to pull the key from somewhere in order to decrypt, what is the best way to do that?