3 ms·

If you use bitwarden - you can set them via bitwarden cli, eg: export DATABASE_URL="$(bw get password my_app/db_url/prod)" And put that in a startup scrip

by e12e 4y ago

If you use bitwarden - you can set them via bitwarden cli, eg: export DATABASE_URL="$(bw get password my_app/db_url/prod)" And put that in a startup script (that can go in version control).

thaumasiotes 4y ago
Where is bitwarden getting the password from?
- deleted 4y ago
  [deleted]
- BiteCode_dev 4y ago
  And what happens on reboot ? Then you get to hardware solutions, and a small website is not going to want that.
  - thaumasiotes 4y ago
    "What happens on reboot" is a good question for a scheme that involves not using the filesystem, but bitwarden is not such a scheme. Everything will be fine after a reboot.
    - BiteCode_dev 4y ago
      You need your app to have the bitwarden decryption passphrase to read it. Do you intent to enter that manually if the server reboots ? If not, then it's a secret you must manage, and you are back to square one: either using a simpler solution, use a hardware key, or going full secure vault service, with privileged first request, and so on.
      - thaumasiotes 4y ago
        The passphrase is hardcoded and kept in version control. ;D
  - e12e 4y ago
    You need to unlock bitwarden. As mentioned above - this is more a solution for local development (against a non-local db). For a service, one would need some kind of secret management - but a shell script could set this variable/value for input to eg docker or a k8s setup. Or the service (eg: heroku) could handle it.
- e12e 4y ago
  This is only a solution for inputting the password. Generally you would set it as a variable on the server (eg: heroku sets this) - but you could provide it on startup for local development/testing.
Izkata 4y ago
This has the same problem that OP refers to with regards to DEBUG: It remains in the environ, and for example if you forgot to set DEBUG=False, Django will just dump the whole environ on the error page. If you can call bitwarden from within the python code somehow, such as with subprocess, that would be better.

by e12e 4y ago

If you use bitwarden - you can set them via bitwarden cli, eg: export DATABASE_URL="$(bw get password my_app/db_url/prod)" And put that in a startup script (that can go in version control).

thaumasiotes 4y ago

Where is bitwarden getting the password from?

deleted 4y ago
[deleted]
BiteCode_dev 4y ago
And what happens on reboot ? Then you get to hardware solutions, and a small website is not going to want that.
- thaumasiotes 4y ago
  "What happens on reboot" is a good question for a scheme that involves not using the filesystem, but bitwarden is not such a scheme. Everything will be fine after a reboot.
  - BiteCode_dev 4y ago
    You need your app to have the bitwarden decryption passphrase to read it. Do you intent to enter that manually if the server reboots ? If not, then it's a secret you must manage, and you are back to square one: either using a simpler solution, use a hardware key, or going full secure vault service, with privileged first request, and so on.
    - thaumasiotes 4y ago
      The passphrase is hardcoded and kept in version control. ;D
- e12e 4y ago
  You need to unlock bitwarden. As mentioned above - this is more a solution for local development (against a non-local db). For a service, one would need some kind of secret management - but a shell script could set this variable/value for input to eg docker or a k8s setup. Or the service (eg: heroku) could handle it.
e12e 4y ago
This is only a solution for inputting the password. Generally you would set it as a variable on the server (eg: heroku sets this) - but you could provide it on startup for local development/testing.

Izkata 4y ago

This has the same problem that OP refers to with regards to DEBUG: It remains in the environ, and for example if you forgot to set DEBUG=False, Django will just dump the whole environ on the error page. If you can call bitwarden from within the python code somehow, such as with subprocess, that would be better.