3 ms·
at work thats fine, we use vault or secrets manager, but neither of those are really suitable for self hosting for toy apps. What do you tell someone using gith
by maccard 5y ago
at work thats fine, we use vault or secrets manager, but neither of those are really suitable for self hosting for toy apps. What do you tell someone using github's free tier and aws/gcp's free tier?
- samcheng 5y agoMost Heroku users are using environment variables for their secrets.
- nijave 5y agoYou can store them in the repo and encrypt them with Mozilla sops. You can use a cloud managed key like AWS KMS or a GPG key. If you manage your own key, you can store it in a password manager or use a USB hardware key to store it You could also use object/blob storage or your local filesystem to store a config file and optionally apply encryption to that
- maccard 5y agoYou've just moved the problem from storing the secret to storing the key in that case though. For AWS KMS, you're now paying [0] for the key storage, and if you use a GPG key, you still need to get it into the application somehow. [0] https://aws.amazon.com/kms/pricing/ https://aws.amazon.com/kms/pricing/
- nijave 5y agoIf you're using a GPG key, you don't necessarily need it to leave your PC. You just need to "re-deploy" the secrets manually when they change from a place that has access to the key