Investigate ways to better manage secrets

[rcarmo]

Right now there are two main approaches to handling secrets outside the ENV file:

• use config:set
• Have your application use an external vault (which is what is done in large scale, regulated environments anyway)

However, there is an interesting middle ground to explore, and things like ssh-crypt may play a role here (although it may not be ideal to manually SSH in to decrypt secrets so you can restart apps after a server failure).

None of these prevent secret exfiltration from a running app (nothing does, really), but it would be interesting to have alternatives here, preferably backed by some kind of at-rest encryption.

[ewalk153]

Have you see ejson and https://github.com/Shopify/ejson2env ? It allows you to keep secrets in the repo, secure at rest.

It’s an opinionated approach to secret management.

I’ve found the ENV/config:set split convenient to separate out variants I don’t mind visible in the repo (ENV) from those I want to keep out of the code (config:set)

In order for the uwsgi daemon to restart processes, it would need access to private key that unlocks secrets or the secrets would need to be stored on the server decrypted at rest, if I’m not mistaken.

[chr15m]

That looks cool, thanks Eric. My preference is for Piku to stay out of opinionated secrets management itself and document a few good options for users.

I will probably test out ejson2env myself, thanks for sharing!

[rcarmo]

This is the kind of thing that we could do with plugins. Anyway, I agree that it might be too much to handle in piku, and that we should probably have a few as suggestions. Moving this to discussions since it won’t impact development directly.