Upgrading My Docker Environment
reddit / selfhosted

----------------------------------------------------------------------
root_15 · 2023-11-18 18:14

I’d like to start storing my docker compose files in git but I’ll
obviously need something for secrets management. Any suggestions?

----------------------------------------------------------------------
ElevenNotes · 2023-11-18 18:47

/.gitignore and .env files?

----------------------------------------------------------------------
latkde · 2023-11-18 18:51

For a selfhosted project: put the Compose files under version control,
and communicate secrets via environment variables that you write into
an `.env` file (and gitignore this file!). You would then manually
create that file during deployment. You may want to ensure that these
files are only readable by root, and not by less privileged users.

----------------------------------------------------------------------
r3dk0w · 2023-11-18 20:16

Like other's have said here .gitignore, but I would also recommend
keeping your git repo private. Github supports free accounts and
private and public repositories, and there's really no reason to have
your private, home services in anything but a private repo.

----------------------------------------------------------------------
root_15 · 2023-11-18 22:46

Interesting. My whole reason for wanting to break out the secrets is
so it would be fine in a public repo.

----------------------------------------------------------------------
tech2but1 · 2023-11-18 22:58

Why make it public?

----------------------------------------------------------------------
root_15 · 2023-11-18 23:09

Why not? Without the secrets they are pretty generic.

----------------------------------------------------------------------
tech2but1 · 2023-11-18 23:16

Yeah I suppose. Guess everyone's gut reaction is "it's from my lab,
keep it private" but most of the files are what we pulled from the
internet anyway! I think the only reason I would keep it private is I
don't really want anyone to have an exhaustive list of the services I
run and the ports I run them all on. Just another very minor layer of
security I guess but why not?

----------------------------------------------------------------------
root_15 · 2023-11-18 23:34

This is a good point. Thanks.

----------------------------------------------------------------------
ElevenNotes · 2023-11-19 06:24

A private repo is not really private. All info is stored on Microsoft
servers, unencrypted. A successful attack against Github and your
secrets are no more. Only upload to github what you would also write
on a piece of paper and leave lying around in public places.

----------------------------------------------------------------------
tech2but1 · 2023-11-19 11:25

I see what you're saying but this is somewhat true of any service
anywhere on the internet. There's got to be a trade off between the
zero trust idea and actually being able to conveniently use a service.

So yes, don't just willy nilly throw secrets and credentials around
everywhere but also have a healthy dose of scepticism. I'd still do
gitignore on .env files even when using private repos anyway, for
instance.

----------------------------------------------------------------------
ElevenNotes · 2023-11-19 11:32

That is the correct way to do it. Just because a repo is private
doesn't mean you can happiliy store all your keys and passwords and
use github as a keepass alternative.

Yes, you should never trust any cloud service, ever. They have all
your data and all your access and much, much more. The relationship in
terms of power is pretty one sided in favour of any cloud provider.

----------------------------------------------------------------------
r3dk0w · 2023-11-19 11:33

>your secrets are no more

My suggestion was to use .gitignore, but also a private repo.

A proper formed .gitignore would block uploading any secrets.

----------------------------------------------------------------------
ElevenNotes · 2023-11-19 11:37

.gitignore > private repo.

----------------------------------------------------------------------
jppp2 · 2023-11-19 12:08

Infisical