Tool: docker compose secrets manager
reddit / selfhosted

----------------------------------------------------------------------
deukhoofd · 2023-12-27 23:45

What does this offer over the [builtin docker compose secrets
setting](https://docs.docker.com/compose/use-secrets/)?

----------------------------------------------------------------------
igor_47 · 2023-12-28 00:14

first, this lets you store your secrets encrypted in the same git repo
where you keep your versioned configuration for your services. you
could store the decryption key as a docker secret, but it helps you
minimize the amount of out-of-band managed items.

next, docker compose secrets are written by themselves into a file in
`/run/secrets/`. in the example you linked, some images support
loading a variable from a file. but -- lots of images do not follow
this convention. what if you need the secret as an environment
variable, and the image does not follow the `_FILE` convention? or --
what if the service in the image wants many secrets together in a
`.ini`/`.yaml`/`.toml` config file? DCSM lets you template secret
values into either config files or (via a templated `env_file`) into
the environment variables.

----------------------------------------------------------------------
bityard · 2023-12-28 00:26

That only works in swarm mode.

If you didn't realize that, I don't blame you, because I once spent
the better part of an hour myself trying to figure out why it wasn't
working. It turns out that the official docs for compose v2 is the
compose specification, which includes things that are not (and will
never be) implemented in v2 compose.

There are multiple bugs open about this sad state of affairs but the
docker devs aren't even pretending to care that it trips up their
users every day.

----------------------------------------------------------------------
theflyingfool · 2023-12-28 00:47

I'll play with this... but any idea if it will work with portainer?

----------------------------------------------------------------------
igor_47 · 2023-12-28 01:01

i generally rely on bind mounts. i don't like docker volumes, because
i prefer files in a file system to some docker abstraction that i
don't fully understand. you can store your secrets and config files in
a repo, and use portainer to bind-mount them into your services. but
i'm not sure how well it will work with, e.g., portainer stacks, since
i don't use those.

----------------------------------------------------------------------
johntheripp3r · 2023-12-28 01:19

I had a look at the docs. I am a bit confused. Can I not inject the
secrets as an environment variable? or in a .env file?

It only works for .template file?

----------------------------------------------------------------------
codeagency · 2023-12-28 09:37

Is this a "lightweight" version from something like infisical?
https://infisical.com/

----------------------------------------------------------------------
deukhoofd · 2023-12-28 10:24

> That only works in swarm mode.

You can't use the docker secrets commands, but it definitely works if
you put them in your docker-compose.yml since docker-compose 3.1.

----------------------------------------------------------------------
igor_47 · 2023-12-28 20:15

If you want secrets as env vars, create an env var template. So, for
`myservice`, I would create a `myservice.env.template` and set env
vars there like so:

```
VAR1=$DCSM{MYSERVICE_SECRET1}
VAR2=$DCSM{ANOTHER_SECRET}
```

in docker-compose, set `myservice.env` as an `env_file`:

```yaml
myservice:
  env_file:
    - myservice.env
  depends_on:
    dcsm:
      condition: service_completed_successfully
```

the `myservice.env` file will not exist until `dcsm` runs, at which
point it will be created from the template.

i'll update the docs in the github readme.

----------------------------------------------------------------------
igor_47 · 2023-12-28 20:16

Infiscal is pretty cool. However, it seems that to inject secrets,
you're limited to environment variables. If you want to template
files, I think you can do that by altering the entrypoint of the
container, but that seems pretty complicated for most `compose` users.
Also, `infiscal` manages your secrets in a UI, which is a good and
popular approach, esp. if you're working with a team. For my smaller
self-hosted projects, I prefer to check an encrypted file into a git
repo.

----------------------------------------------------------------------
codeagency · 2023-12-28 22:22

I haven't had a use case yet where I would need template files but I
get sometimes other tools are necessary for specific results.
And infisical also has a CLI, so you can choose UI or CLI.
I think the CLI probably has options for templates too?

----------------------------------------------------------------------
Shot-Bag-9219 · 2023-12-29 19:50

You should check out Infisical Agent templating:
https://infisical.com/docs/infisical-agent/overview