Investigate ways to better manage secrets about piku HOT 3 CLOSED

That looks cool, thanks Eric. My preference is for Piku to stay out of opinionated secrets management itself and document a few good options for users.

I will probably test out ejson2env myself, thanks for sharing!

from piku.

Have you see ejson and https://github.com/Shopify/ejson2env ? It allows you to keep secrets in the repo, secure at rest.

It’s an opinionated approach to secret management.

I’ve found the ENV/config:set split convenient to separate out variants I don’t mind visible in the repo (ENV) from those I want to keep out of the code (config:set)

In order for the uwsgi daemon to restart processes, it would need access to private key that unlocks secrets or the secrets would need to be stored on the server decrypted at rest, if I’m not mistaken.

from piku.

This is the kind of thing that we could do with plugins. Anyway, I agree that it might be too much to handle in piku, and that we should probably have a few as suggestions. Moving this to discussions since it won’t impact development directly.

from piku.