Skip to content
Register

What do you use for secrets management across cheap VPS fleet?

General Discussion by hankels 13 replies 1.8K views
hankels

Member OP

52 VPS and counting

13 #1

I run 52 boxes (mix of Contabo and OVHcloud, don't ask) and I've been going in circles on this. Tried HashiCorp Vault on a KnownHost 2GB instance for a month. RAM usage alone ate 40% of the plan. At $6/mo for that VPS plus the complexity... math doesn't work.

Bitwarden self-hosted: better? Still heavy. Needs Docker, needs 1GB comfortable. Across my fleet that's 52 passwords, API keys, SSH junk. Plain files with ansible-vault maybe? But then I'm pushing encrypted blobs everywhere and praying.

What's your creative compromise for sub-$5/mo infrastructure where "enterprise grade" is a joke?

Current setup:

  • Different password every server (generated, 20+ chars)
  • Encrypted spreadsheet on local machine
  • Pray nothing leaks

Surely someone has a dumber-smarter solution.

seedbox, NAS, tape, and three offsite
liam_funky

Member

Vancouver

#2

1. I feel your pain
2. Here is my ranking of terrible options
A) Vault = beautiful overkill
B) Bitwarden = slightly less overkill
C) Pass (unix password store) with git = actually decent
I. GPG key per "tier" of server
Ii. scp or git pull on deploy
3. What I actually do though
1. Keepass file on a $3/mo HostHatch box — https://hosthatch.com
2. SSHFS mount when I need it
3. Disconnect immediately after
4. Is this secure
A) no
B) is anything
5. Cost analysis
I. $3/mo
Ii. 0GB RAM on target boxes
Iii. Acceptable risk for my 38 boxes

prague1983

Member

btw I use Arch

#3

Just use pass

Seriously. GPG + git. Zero server-side RAM. Skill issue if you need a web UI for 52 passwords

My entire infra secrets: 4KB git repo. Clone, decrypt, done. The 'enterprise' people running Vault on 512MB boxes are the same ones who run kubernetes on a single VPS and wonder why it OOMs

hankels said:
Current setup: Different password every server (generated, 20+ chars) Encrypted spreadsheet on local machine Pray nothing leaks Surely...

You're already 80% there. Replace spreadsheet with pass and stop praying

oops: 0000 [#1] SMP
PacketpunkUma

Member

#4

Pass is a CLI tool! No web interface! Do you hate yourself!

I tried vault on a 1GB box! It died! I watched it die!

Here is what works! Listen!

  • 1password CLI on your laptop
  • ssh key only on servers
  • No secrets live on VPS at all
  • Deploy via ansible from machine with secrets
  • Disconnect! Forget! Never log in again!

Your spreadsheet method is fire! Embrace the chaos! Add colors! Sort by emotional attachment to each box!

tallinnying

Member

Night Shift

#5

Tried to build a secrets thing at 3am once. Used sqlite + age encryption + a bash script that maybe works

Anyway it stores everything in a single file I scp around. Idk why I do this. The file is named `dont_look` and I have 6 copies of it on different machines with different timestamps and I don't remember which is canonical

PacketpunkUma said:
SORT BY EMOTIONAL ATTACHMENT TO EACH BOX!

I did this accidentally. The OVHcloud box that crashes weekly is named `regret`. The stable one is `boring`. I only remember `regret`'s password because I type it so often fixing it

builds at 3AM, sleeps at noon
annexbi

Member

2 #6

I used to run Vault (it was fine (actually it wasn't (the RAM thing)))) then I switched to sops (mozilla's thing (very nice (works with age now))) but honestly (and here is where I lose people (including myself sometimes)) the spreadsheet method has a certain elegance

(parenthetical count: 6 (I think (losing track)))

@hankels your "pray" step is load-bearing. Never remove it. All security is prayer with extra steps

push. done. coffee.
Joy

Member

#7

I am try Vault pirst time last month xixixi

Very heaby lah. My 512MB box is cry. I am buy more RAM yesterday actually

Now I am use pree pass + git. Very simple. No problem. Password is store in.pgp I am porget where I put key sometimes xixixi

My secret: I am still keep old excel pile. "backup" lah. Pirst rule: never trust only one thing

Zurich1984

Member

#8

HostHatch $3 box for secrets? One breach and you're cooked.

/24 for sale. No lowballs.
quinnbizz

Member

#9

@Zurich1984 HostHatch was never in my stack, but the breach risk is real anywhere at that price. Take it with a grain of salt, but IMO the real problem is lateral movement once you're in, not which $3 box held the file.

...
olespete

Member

Trust No One

#10

Same with Vault, their RAM appetite is a fiction novel.

airgapped, encrypted, faraday'd, still worried

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft