Hands-on guide series
Secrets Management on a VPS: A Hands-On Guide
A four-part, hands-on guide to handling secrets on a single VPS: how plaintext secrets leak through permissions, the process environment, logs and git history, file-based secrets with a dedicated owner and systemd credentials, encryption at rest with age and sops, and rotation, auditing and git-history scrubbing. Every command tested on a live Ubuntu 24.04 server with throwaway demo secrets.
What you will build
Security is layers, not a switch. Each part closes a different category of attack, from the automated sweep that finds a brand-new server, to the day one gets in anyway. Read them in order, or jump to what you need.
- 1
The Problem With Plaintext SecretsStart from the encrypted end state, then watch plaintext secrets leak on a slice through file modes, the process environment, logs and git history.8 min - 2
File-Based Secrets Done RightDo file-based secrets right on a slice: a dedicated owner at mode 600, systemd LoadCredential kept out of the environment, and a tmpfs for runtime secrets.6 min - 3
Encrypt Secrets at Rest with age and sopsInstall age and sops on a bare slice, encrypt secrets at rest so the ciphertext is safe to commit, then decrypt the round-trip at deploy time with the key.7 min - 4
Secret Rotation, Auditing and Git-History ScrubbingRun the full secret rotation lifecycle on a slice: swap a key atomically, audit who can read it, and scrub a committed secret from git history for good.7 min