Secrets Don't Belong in Config
13 hours ago
- Secrets (passwords, API keys, tokens) should not be stored in application configuration files because configuration and secrets have different lifecycles and access requirements.
- A quarter of NixOS modules (110 out of 445) safely retrieve secrets but then merge them into configuration at runtime, creating security-sensitive workarounds like envsubst or custom scripts.
- Mixing secrets with configuration in a single file complicates rotation, access control, and code sharing, as seen in Cachix where cache configuration and credentials were combined.
- Applications should accept secrets through dedicated runtime channels such as password_file settings, systemd credentials, scoped environment variables, or external secret providers.
- SecretSpec is a proposed solution that separates secret declarations (secretspec.toml) from their actual values, allowing providers like system keyring or cloud services to resolve them per environment.
- The goal is to have consistent secret handling across development, CI, and production without requiring organizations to build their own secrets platform.