Hacker News Reader

Comment by minebreaker | Hacker News Reader

I'm always looking for the secret management solution for my self hosted apps. This looks very cool, but still unable to solve my biggest problem - how should I manage secrets to access the secret manager?

In my day job, we use AWS SSM. It works great. For my home network, I just put secrets on my docker-compose.yaml. Obviously I shouldn't but I can't find a better solution.

View on HN

If you run Docker in Swarm mode instead (docker stack deploy instead of docker compose up), then you can make use of Swarm secrets. You don't have to make full use of Swarm; it can be a single node with a single instance of the service(s). As I manage the host with Ansible, I'm able to use Ansible's Docker module with a play to communicate the current secrets to Swarm, so that they are available to the services. On the Ansible side, the secrets are encrypted at rest using ansible-vault.

Swarm mode is IMHO underrated.

I’ve written a small Python app to deploy to Swarm mode from CI pipelines, and configure secrets and configs from CI environment variables, taking care of rotation and recreating Swarm secrets if the variable content changes. This delegates the whole secret management to the CI tool (BitBucket in my case).

The default implementation in Swarm has the problem that you cannot update secrets, so you’ll need to reconfigure and redeploy the service with a secret with a new name if that changes. That was quite a pain!

I encountered the secret update problem too. I have a secret rotation playbook that stops the Docker services stack, removes the secrets, recreates under the same name, and restarts the Docker services stack. The community.docker Ansible module does all the lifting there.

My CI runs as a container in that stack too, so in Jenkins I have an init.d Groovy script to establish Jenkins Credentials from the current Swarm secrets.

I'm not sure if this would be a solution for you, and I've never used it myself, but I found this interesting secrets management project a few years ago that I always find myself thinking "is that what I want?":

https://git.sr.ht/~egtann/shh

It looks unmaintained, unfortunately, and a link in the README to an article that gives some background is broken (but archived: https://web.archive.org/web/20201128160302/https://www.egt.r...)

Like I said, I haven't used it, I can't vouch for it, but it looked interesting for my own use, which is personal/small team, with an emphasis on simplicity.

Take that for what it's worth! :)

I find 1Password and their CLI app great for my homelab.

I like sealed secrets (https://github.com/bitnami-labs/sealed-secrets) a lot. It's like 1Password, but for apps in kubernetes. You only need to secure a private key, and can throw encrypted secrets in a public github repo or anywhere you want.

It's owned by VMware (Broadcom) now, so you have to decide which company you hate less.

For your home network, you might like Mozilla SOPS for secrets storage. You can keep your secrets in an encrypted file and have a container that loads those secrets and puts it into each service's environment variables. At least that way you aren't committing plaintext secrets to source or having them laying around in the clear, plus it's a breeze to manage and edit them.

I hold my vault seal key in my KeePass database. It's set to start and prompt for the master password when I login and it integrates into the FreeDesktop/DBus secrets API (and ssh-agent). Obviously I only need the seal/root tokens when the Vault server reboots. Once it's running it hands out secrets and certificates to everything else.

Reply on news.ycombinator.com