6 ms·

There isn't really a way around it.

• otabdeveloper4 5mo ago
  There is -- you can expose a UNIX socket for serving credentials and allow access to it only from a whitelist of systemd services.
  • rcxdude 5mo ago
    They would still exist in plaintext, just the permissions would make it a little harder to access.
    • otabdeveloper4 5mo ago
      No, UNIX sockets work over SSL too. You can, theoretically, decompile the system memory dump and try to mine the credentials out of the credential server's heap, but that exploit is exponentially more difficult to do that a simple `cat /proc/1234/environ`.
  • lemagedurage 5mo ago
    That works on a single persistent box, but unfortunately, that means giving up on autoscaling, which is not so nice for cloud applications.
    • otabdeveloper4 5mo ago
      You can proxy the UNIX socket to a network server if you want to. You can even use SSL encryption at all times too.
      • lmz 5mo ago
        Once it's networked you lose the "whitelist of systemd services" and it's then no different from any networked secret store.
        • otabdeveloper4 5mo ago
          No, this is a solved problem: https://spiffe.io/ https://spiffe.io/ You can do service attestation securely, even for networked services.
          • burnished 5mo ago
            Nice. Really grateful for your participation in this comment tree
• jimnotgym 5mo ago
  Run your own servers so the .env isn't shared with your hosting provider?