Tried Hetzner, got VAT headaches because Mexico. Stuck with DigitalOcean for the VPS, Bitwarden cloud for personal, and I sleep fine too.
My traceroute to their Frankfurt DC is prettier than my secrets setup anyway.
Member
How do you store the Bitwarden service account credentials? Asking because I built networks you use and can't remember my own WiFi password, let alone rotate a service account secret securely.
This is the turtle problem.
Member
Machine identity from Hetzner. Role attached to the server, not a credential I store. The CLI logs in with that.
Not perfect. Better than env files in git.
It is my humble opinion that the turtle problem is indeed the central challenge. I apologize for the circularity of this observation, yet one must bootstrap trust somewhere.
For my own modest homelab, I have settled upon TPM-backed keys where the hardware permits, and I acknowledge this is not universally available.
TPM? In Budapest we still have servers from before TPM existed. I use SOPS with age keys on a YubiKey I keep in a drawer. Rotation means walking to the drawer.
Sometimes low tech is the right tech.
This. SOPS + age is underrated for small teams. I use it with GitHub Actions, keys in repo settings not in repo.
Not enterprise grade but neither is my sleep schedule.
Noting that GitHub repository settings for Actions secrets are within policy, provided the repository remains private and access is audited.
SOPS + age is acceptable for our platform users. Plaintext files in git remain a violation regardless of repository visibility.
— Admin
Member
Noted. Will look at sops.
Still think admin is overreacting for personal repos but their house their rules.
Member
Tanie serwery to moja pasja, ale tanie sekrety to już nie.
I run Vaultwarden on OVH in Gravelines. 3 euro VPS, backups to C2. For personal projects this is enough.
For work we pay HashiCorp because someone else signs the contract.
Member
ZFS send to another box, encrypted with keys in TPM. RAID is not a backup, but ZFS send to a different provider might be.
I don't trust any single secrets manager. I trust ZFS snapshots I can roll back.
