Skip to content
Register

What do you use for secrets management across multiple cheap boxes?

General Discussion by pauloserver 23 replies 1.6K views
pauloserver

Member OP

#1

Cara, I am going to tell you something shameful. I have twelve HostHatch VMs and I am using.env files in every single one. Same API keys. Same database password. I copy with scp. If one box is pwned, they all are. I know this. I know.

I tried to read about HashiCorp Vault and véi, that thing is going to cost more than my entire infrastructure. I am not going to run a cluster for secrets when my clusters cost $3/month. What do you actually use? Kkkkk I need real answers from poor people.

My stack: docker compose, https://docs.docker.com, debian, shame.

chill infrastructure for chill people 🦫
GE

Member

#2

Age + sops

Light

Fighting!

No cluster needed just git

Chen

Member

☁️ multi-cloud mess

#3

Sops can lor. Encrypt with age key. Commit to repo. Pull on box. Decrypt at runtime. One key per environment if you fancy. No need vault leh. Can one.

cpanelliw780

Member

shared hosting survivor

#4

Lol I just use the same password everywhere not proud of it but it works my logic is if they get in one box they probably got in through something dumb like wordpress so the password doesnt matter I have 40 boxes on various providers all the same root pass I know I know

tifiucem

Member

🇹🇷 cheap vps hunter

#5

Bro dont do this. Sops is free. You can encrypt with age no need vault. I am running sops on 8 boxes $0 cost. Setup is 30 minutes.

Tifiucem's sops budget: $0.
Tifiucem's sleep at night: priceless!

çok ucuz, çok hızlı
sander_ams

Member

#6

Same .env scp problem on 12 boxes...

pauloserver

Member OP

#7
sander_ams said:
Same .env scp problem on 12 boxes...

This is the part that scares me. My laptop dies, my house burns, my key is gone. Then what? Do I need to back up the age key somewhere? Where do you put it that is not also a secret management problem?

chill infrastructure for chill people 🦫
Chen

Member

☁️ multi-cloud mess

#8
pauloserver said:
My laptop dies

You make backup lor. Print on paper put in safe. Or split with shamir. Or just encrypt the age key itself with password and store in Bitwarden free tier. Got many way one.

tifiucem

Member

🇹🇷 cheap vps hunter

#9
pauloserver said:
Where do you put it that is not also a secret management problem?

I have three copies. One on Yubikey. One in bank safe deposit box in Istanbul, printed. One encrypted with my mother's maiden name as password and uploaded to Proton Drive. Paranoid? Maybe. But my VPS bill is $14/month total so I can afford a Yubikey once.

çok ucuz, çok hızlı
techmei

Member

#10

Bitwarden free tier works for age key backup. I do this. Export encrypted json, store in three places. Taiwan has cheap safe deposit boxes too.

But honestly for twelve VMs have you considered just one small Vaultwarden instance somewhere? Not for secrets, for the key backup itself.

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft