secrets management

Bilingual

Where .env Went Wrong
2 months ago
- .env files started as a convenient shortcut for setting environment variables but evolved into a flawed architecture for configuration and secrets management.
- They lack a schema, cannot express whether a value is required, secret, or environment-specific, leading to late failures and drift.
- The proliferation of .env files (e.g., .env.production) recreates brittle named environments, contradicting Twelve-Factor App principles.
- There is no formal specification; different parsers handle variable expansion, quotes, and precedence inconsistently, causing subtle bugs.
- Security issues arise because .env files are often committed, copied, or leaked, and they offer no encryption, access control, or auditing.
- The article proposes SecretSpec as a solution: a committed declaration file separates requirements, protected storage, and explicit delivery, reducing reliance on environment variables for secrets.
SecretSpec 0.17: Scopes, secrets caching, SOPS, age, and systemd credentials
2 months ago
- SecretSpec 0.17 introduces scopes to limit each service or task to only its declared subset of a profile.
- Secrets caching allows a slow fallback route to be cached locally with bounded freshness and explicit invalidation.
- Cross-secret validation enables declaring alternative or mutually exclusive credentials instead of marking every value independently required or optional.
- New providers include SOPS, age, KeePass KDBX, OpenBao, Scaleway Secret Manager, and systemd credentials, with JWT/OIDC authentication for Vault and OpenBao.
- GitHub and Forgejo Actions can now resolve a profile and expose secrets to subsequent steps, with tokenless authentication via OIDC.
Secrets Don't Belong in Config
2 months ago
- Secrets (passwords, API keys, tokens) should not be stored in application configuration files because configuration and secrets have different lifecycles and access requirements.
- A quarter of NixOS modules (110 out of 445) safely retrieve secrets but then merge them into configuration at runtime, creating security-sensitive workarounds like envsubst or custom scripts.
- Mixing secrets with configuration in a single file complicates rotation, access control, and code sharing, as seen in Cachix where cache configuration and credentials were combined.
- Applications should accept secrets through dedicated runtime channels such as password_file settings, systemd credentials, scoped environment variables, or external secret providers.
- SecretSpec is a proposed solution that separates secret declarations (secretspec.toml) from their actual values, allowing providers like system keyring or cloud services to resolve them per environment.
- The goal is to have consistent secret handling across development, CI, and production without requiring organizations to build their own secrets platform.

secrets management

Where .env Went Wrong

SecretSpec 0.17: Scopes, secrets caching, SOPS, age, and systemd credentials

Secrets Don't Belong in Config