Hacker News Reader

Comment by asdff | Hacker News Reader

It doesn't help that so many tools are like "give me your secret key in plain text in the config file" without at least offering a link to a webpage on the github of how you could secure your keys and use this software

View on HN

hardcoded creds in example documentation... T_T

Use vault, env vars, GitHub/GitLab secrets, anything but string literals!!!

Vault is not just a drop in and go system - setting up a vault instance is an ordeal in and of itself, and the pricing for vault on hashicorp cloud is incredibly expensive. The problem with the other options is that you have to get the secrets into environment variables, or out of github/lab secrets and into your application. To use most of the services like AWS secrets manager, vault, etc, it will cost you more to manage secrets than it will to host the app on a small DO droplet for example.

Self-hosted Vault within a minimum Kubernetes cluster in GCP costs us roughly $35 a month. Maintenance effort can be neglected if not scaling. Vault has its learning curve there but I think it's totally worth it, given its secret management and API-first features integrated with many other DevOps tools.

$35/month is more than a small team will pay on source control.

If anyone’s looking for something more secure than vanilla env vars but simpler than Vault, you could check out EnvKey[1]. Disclaimer: I’m the founder.

It’s end-to-end encrypted, cloud or self-hosted, and very quick to integrate.

1 - https://envkey.com

It feels like just only yesterday secrets in env vars were considered faux pas :)

Reply on news.ycombinator.com