3 ms·

I see that you guys do auth using ssh https://github.com/picosh/ptun https://github.com/picosh/ptun and generally use ssh identities heavily. I think you might

I see that you guys do auth using ssh https://github.com/picosh/ptun https://github.com/picosh/ptun and generally use ssh identities heavily. I think you might wanna consider providing a vault alternative that's based on ssh identities too. Here is my draft implementation of this idea https://taras.glek.net/post/github-to-sops-lighter-weight-secret-management/ https://taras.glek.net/post/github-to-sops-lighter-weight-se... I wrote my crappy script in anger at how poorly passwords integrate with gitops workflows. It's just a matter of making a nice UX for this flow to make it useful. All the libs you need for this are already done in go.

nurple 2y ago
Interesting script! Really dig how it harvest pubkeys from a GitHub org. Does it support fine grained control of which secrets are available for decryption by a particular key?
- tarasglek 2y ago
  My script just sets up default .sops.yaml for https://github.com/getsops/sops https://github.com/getsops/sops You can further edit .sops.yaml(eg have multiple of them) and decide how you split secrets in your directory tree to further customize who can decrypt the secrets. It works pretty well for prod/dev splits, etc