Skip to content
Register

What do you use for secrets management on a budget?

General Discussion by YuriDavid 3 replies 145 views
YuriDavid

Member OP

5 #1

---
- problem scope
- 3 VPS
- 2 people
- no budget for enterprise
---
- evaluated
- HashiCorp Vault
- WARNING: overkill
- NOTE: needs HA to not be worse than nothing
- 1Password/Bitwarden teams
- WARNING: subscription creep
- pass + git
- clean
- gpg key management still painful
---
- current stack
- vaultwarden (self-hosted)
- drop-in compatible
- docker compose, 256MB RAM
- age encryption for CLI secrets
- NOTE: no gpg agent nonsense
---
- considering
- sops with age
- secrets in git with age encryption
- has anyone production'd this?
---

YuriDavid

indentation is not optional
dave39

Member

#2

Scrap gods been good to me ,,,,, I run pass on a thinkpad from 2011,,,,, Synced over syncthing,,,,, No cloud no subscription no corporation,,,,, My secrets file is 4kb after ten years,,,,, You young people with your vaults and your wards,,,,, Just gpg and sleep,,,,, ~~dave

ronwit

Member

Budget King

9 #3

Actually I use sops basically but with age key, not gpg (´・ω・｀)

My workflow is like this
- encrypt secrets.yaml with age public key
- commit to git
- CI server has private key

Very clean actually no agent forwarding nightmare

@YuriDavid do you use multiple recipients?? Basically wondering if team rotation is painful

instant noodles, instant deploys
pablo

Member

#4

Wey I do the git+age thing bro.

My setup is like this bro:
- .sops.yaml in repo root
- age keys per environment
- CI pulls from git and decrypts

Double check this bro,, I pipe secrets to docker compose with env_file,, no cloud provider secrets manager,, no bill!

? What about key rotation though wey,, I still havent figured that out,, help

declarative or death

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft