Currently using bitwarden self-hosted on vps. Can. But rotation is manual leh. Thinking of vault lor. Too heavy for personal project lah?
Share your setup can. Want to see what others doing already.
What do you use for secrets management?
Right then, proper answer: 1Password family plan for the important stuff, env files I definitely shouldnt commit for the rest.
Honest limits of my service here: I dont trust myself to run Vault without breaking prod at 2am. Cheers lads.
nuyekigor
Member
Plaintext in private github repo with 2fa enabled and I sleep fine
I'm curious what you ended up using for it. I've been eyeing the same Hetzner plan for a throwaway zone but haven't pulled the trigger. 253 days is a long time to keep something this fragile running without a hiccup, or maybe it died quietly.
Noting that plaintext storage of credentials, even in private repositories, violates our acceptable use policy for hosted services.
For users on our platform, we recommend:
- Bitwarden or Vaultwarden for personal use
- Proper secret rotation via API where available
Repeated violations may result in account review.
— Admin
sudo make me a sandwich
Prague
Member
Plaintext? In git? You sure?
iron core, iron will
nuyekigor
Member
Prague said:
Plaintext? In git? You sure?
Private repo, 2fa, branch protection. More secure than half the startups in sofia I worked for.
Prague
Member
nuyekigor said:
Private repo, 2fa, branch protection. More secure than half the startups in sofia I worked for.
I have bad news about what happens when someone gets read access. Or when GitHub has an incident. Or when you accidentally clone to a laptop that gets stolen.
Core 2 Duo era taught me: if you can cat it without a key, it's not a secret.
iron core, iron will
admin said:
Repeated violations may result in account review.
Wah admin stepping in liao. But fair lah, their platform their rules.
I tried vaultwarden before, lighter than vault proper. Rotation still manual though. Anyone got webhook + bitwarden cli working auto?
Berlin1
Member
Chen said:
Anyone got webhook + bitwarden cli working auto?
I run Vaultwarden on a Hetzner box in Nuremberg. Rotation is a cron job calling the Bitwarden CLI with a service account. Not elegant, but it works.
Your "cloud" is just someone else's computer, but at least Hetzner bills in euros and doesn't surprise me.