Sign inSign up

nyulibraries/decrypt

By nyulibraries

•Updated over 8 years ago

Decrypt secrets

Image
0

1.1K

nyulibraries/decrypt repository overview

⁠Secrets Strategy

Using GPG we should have pretty good privacy for our configurations and secrets:

docker run --rm -v $(pwd):/app -e "RAW=/app/raw.txt" -e "ENC=/app/enc.txt.enc" -e "PASSPHRASE=$PASSPHRASE" nyulibraries/encrypt
docker run --rm -v $(pwd):/app -e "ENC=/app/enc.txt.enc" -e "RAW=/app/raw.txt" -e "PASSPHRASE=$PASSPHRASE" nyulibraries/decrypt

⁠Workflow

~$ git clone ssh://git-codecommit.us-west-2.amazonaws.com/v1/repos/{SECRETS_REPOS} tmp/secrets_repos
~$ export PASSPHRASE=`echo -n mypassphrase | base64`
~$ docker run --rm -v $(pwd):/app -e "ENC=/app/tmp/secrets_repos/enc.txt.enc" -e "RAW=/app/tmp/secrets_repos/raw.txt" -e "PASSPHRASE=$PASSPHRASE" nyulibraries/decrypt
~$ kubectl apply
# Or
~$ cap deploy
# Or however else you are using these secrets within your application
~$ rm -rf tmp/secrets_repos

⁠Policy

  • Be responsible for secrets files:
    • Don't put unencrypted secrets in any source control
    • Store encrypted files in a private repos, preferably on CodeCommit
    • Don't leave files unencrypted on local machines, or ideally on remote servers either
    • Be sure to .dockerignore your secrets as well as .gitignore
  • Be responsible for the master key:
    • Never store the master key in version control, in plain text or encrypted
    • If you have to deploy the master key into an application environment, do so in the environment or within a docker/k8s secret
    • It's OK for your CI/CD to know about your master key

Tag summary

Content type

Image

Digest

Size

8 MB

Last updated

over 8 years ago

docker pull nyulibraries/decrypt