2 ms·
We (Shopify) use https://github.com/Shopify/ejson https://github.com/Shopify/ejson -- we store encrypted secrets in the repository, relying on the production se
by burke 11y ago
We (Shopify) use https://github.com/Shopify/ejson https://github.com/Shopify/ejson -- we store encrypted secrets in the repository, relying on the production server to have the decryption key.
It's relatively common to provision secrets with configuration management software like Chef/puppet/ansible/etc using, e.g. Chef's encrypted data bags.
Another slightly heavier-weight solution with some nice properties is to use a credential broker such as Vault: https://www.vaultproject.io/ https://www.vaultproject.io/
- notduncansmith 11y agoJust wanted to +1 the suggestion for Vault - I've found it to be a really nice balance between usability and security.
- e12e 11y agoFor ansibile the built-in solution is: http://docs.ansible.com/ansible/playbooks_vault.html http://docs.ansible.com/ansible/playbooks_vault.html