cowboy / bots Goto Github PK

Right now, I want to avoid using a separate system for managing secrets, because I have very few of them. To that end, I'm using ansible-vault to encrypt a vault.yml ansible vars file that gets committed with the project.

The idea is that, since all the secrets I care about are already stored in a .gitignored .env file that my app also consumes as if they were environment vars, via the dotenv lib, I can just programmatically convert the .env file, which looks something like this:

SECRET_ONE=some_secret_value
SECRET_TWO=another_secret_value
...

Into the vault.yml ansible vars file, which looks something like this:

---
vault_env: |
  SECRET_ONE=some_secret_value
  SECRET_TWO=another_secret_value
  ...

That gets used in an upstart script template file like so, effectively making them actual environment vars for the app process to use:

...
{% for key in vault_env.splitlines() %}
env {{key}}
{% endfor %}
...

script
  /usr/bin/npm start --prefix {{site_path}}
end script

And I've created a fairly simple bash script that does the .env -> vault.yml -> encrypt so that updated secrets can be easily committed.

I might also make a decrypt-env.sh script that reverses the process, creating a .env file from the vault.yml, to facilitate that process, should I need it.

But before I do that, does this approach make sense? /cc @tkellen @gnarf @MattSurabian