What do you use for secrets management across cheap VPS fleet?

Update: I tried pass for 48 hours. GPG key migration was fine, git setup was fine. Then I realized I need to rotate a database password across 17 boxes and I'm back to wanting a web UI. Pass is great until it isn't.

Currently testing: sops + age with a git repo. @annexbi you got me curious. One encrypted YAML per server, decrypt on deploy, zero persistent secrets on target. Still figuring out the key distribution part.

Also @liam_funky your HostHatch+SSHFS thing is growing on me as a fallback. $3 is hard to argue with.

I accept this diagnosis. But I also accept that I have 52 passwords.

This is why I said NEVER LOG IN AGAIN

If you are rotating passwords by hand you have already lost! The machine rotates! You watch! You drink tea!

I use ansible with 1password CLI lookup plugin. The secrets breathe in, breathe out, never touch the VPS disk as files. Ansible temp memory only. Gone when playbook ends.

You distribute ONE key. Your SSH key. Everything else is a variable lookup from your laptop. This is not hard. You are making it hard because you want infrastructure to feel like infrastructure. Let it be a script. Let it be boring.

My electric bill is still too high.

Reseller perspective: 90% of my clients should not be managing their own secrets. They should be paying me to not let them.

For the 10% who insist: I put them on Bitwarden cloud, not self-hosted. The $10/year personal plan. I sleep fine. They lose their master password anyway and I reset it.

Second rule: never trust the client with two things.

Self-hosted anything on sub-$5 Contabo is a liability letter waiting to happen. I have seen things. OVHcloud Gravelines had a fun week once and three of my clients discovered what "no SLA" means — https://status.ovhcloud.com.

And when your laptop dies? When you are on a train with your phone only? When ansible decides today is the day to deprecate that lookup plugin?

This is not resilience. This is "works on my machine" elevated to infrastructure theology.

Pass + git works from any machine with your GPG key. I have mine on three laptops and one YubiKey. The git repo is on my own server in Prague, not some $3 HostHatch fantasy. Cost: zero extra. RAM: zero. Complexity: you already know GPG or you are in the wrong thread.

For box in $(cat server_list); do pass show db/$box | ssh $box 'cat > /tmp/secret && systemctl restart app'; done

Is it pretty? No. Does it work in 30 seconds? Yes. Add a Makefile if you need ceremony.

The spreadsheet people are honest at least. The "cloud secrets from my laptop" people are one dropped ThinkPad from a very bad weekend.