Secrets guides
Hands-on guides that cover Secrets. Every command is run and verified on a live server before it is published.
GuideThe Problem With Plaintext Secrets
Start from the encrypted end state, then watch plaintext secrets leak on a slice through file modes, the process environment, logs and git history.
GuideFile-Based Secrets Done Right
Do file-based secrets right on a slice: a dedicated owner at mode 600, systemd LoadCredential kept out of the environment, and a tmpfs for runtime secrets.
GuideEncrypt Secrets at Rest with age and sops
Install age and sops on a bare slice, encrypt secrets at rest so the ciphertext is safe to commit, then decrypt the round-trip at deploy time with the key.
GuideEnvironment, Config and Secrets
Configure a node.js app through the environment and keep node.js secrets in a 600 file only the service user can read, with NODE_ENV set to production.
GuideSecrets in CI
Handle secrets in CI the safe way: a 600 env file outside the repo, a build that uses a token without printing it, and a scan proving nothing leaked.
GuideFlask Config, Environment and Secrets
Configure a Python app through the environment and keep its secrets in a 600 file the service user reads, with the value masked in every log line.
GuideConfig and Secrets
Feed a pod its settings with a ConfigMap and Kubernetes Secrets on k3s, mount both, and watch the app read them with the secret kept masked.