Secrets in Deployments¶

# Start Vault in dev mode (NOT for production)
vault server -dev

# Set environment variable
export VAULT_ADDR='http://127.0.0.1:8200'

# Write a secret
vault kv put secret/myapp \
  DATABASE_URL=postgres://user:pass@prod-db:5432/MyApp \
  JWT_SECRET=supersecretkey123

# Read a secret
vault kv get secret/myapp

# From Node.js
npm install @hashicorp/vault-client

const vault = require('@hashicorp/vault-client')

const client = new vault.Client({
  address: process.env.VAULT_ADDR,
  token: process.env.VAULT_TOKEN
})

async function getConfig() {
  const response = await client.secrets.kv.v2.read({
    mount: 'secret',
    path: 'myapp'
  })
  return response.data.data
}

# Create secret
aws secretsmanager create-secret \
  --name myapp/production \
  --secret-string '{"DATABASE_URL":"postgres://...","JWT_SECRET":"..."}'

# Retrieve in Node.js
npm install @aws-sdk/client-secrets-manager

const { SecretsManagerClient, GetSecretValueCommand } = require('@aws-sdk/client-secrets-manager')

const client = new SecretsManagerClient({ region: 'us-east-1' })

async function getSecret() {
  const response = await client.send(
    new GetSecretValueCommand({ SecretId: 'myapp/production' })
  )
  return JSON.parse(response.SecretString)
}

# Fetch secrets as env vars
doppler secrets download --format env --config prd > .env.production

# Or inject directly
doppler run -- node server.js

# Works in CI with GitHub Actions
doppler run --command="npm run deploy" --token=$DOPPLER_TOKEN

# Install git-crypt
sudo apt install git-crypt

# Initialize in your repo
git-crypt init

# Specify which files to encrypt in .gitattributes
echo ".env filter=git-crypt diff=git-crypt" >> .gitattributes

# Add GPG key or symmetric key
git-crypt add-gpg-user KEY_ID

# Lock/unlock
git-crypt lock
git-crypt unlock

# The .env file is encrypted in git , decrypted on checkout

# Alternative: sops (SOPS) from Mozilla
# Encrypts values but keeps structure visible

# .sops.yaml
creation_rules:
  - pgp: >-
    YOUR_PGP_KEY_FINGERPRINT

# .env.encrypted — values encrypted , keys visible
DATABASE_URL=ENC[AES256_GCM,data:encryptedbase64==,iv:...,tag:...]
JWT_SECRET=ENC[AES256_GCM,data:...,iv:...,tag:...]

# git-secrets — scan before commit
git secrets --scan
git secrets --add 'DATABASE_URL=postgres://.*:.*@'

# Install as pre-commit hook
git secrets --install

# trufflehog — scan entire repo history
trufflehog git file://. --since-commit HEAD~10

# detect-secrets from Yelp
detect-secrets scan . > .secrets.baseline
detect-secrets audit .secrets.baseline

# GitHub secret scanning (enabled by default on public repos)

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.5.0
    hooks:
      - id: detect-private-key

  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.4.0
    hooks:
      - id: detect-secrets
        args: ['--baseline', '.secrets.baseline']

  - repo: https://github.com/awslabs/git-secrets
    rev: master
    hooks:
      - id: git-secrets

# THIS DOES NOT REMOVE FROM FORKS OR CLONES
# But it's better than nothing

# 1. Find the commit
git log --all --oneline | grep -i "secret\|password\|key"

# 2. Remove with BFG Repo-Cleaner
java -jar bfg.jar --replace-text passwords.txt repo.git

# 3. Force push (requires force push override)
git push --force

# 4. Rotate the secret IMMEDIATELY
# The old secret is still compromised

# 5. Remove from GitHub cache
# Contact GitHub support to purge cached data

# Dockerfile
RUN --mount=type=secret,id=npm_token \
    NPM_TOKEN=$(cat /run/secrets/npm_token) \
    npm install --registry=https://private-registry.com

# Build command
docker build --secret id=npm_token,src=./npm_token.txt -t myapp .

services:
  app:
    image: myapp
    environment:
      # These are passed at runtime , not baked into the image
      - DATABASE_URL=${DATABASE_URL}
      - JWT_SECRET=${JWT_SECRET}
    secrets:
      - db_password

secrets:
  db_password:
    file: ./secrets/db_password.txt

# NEVER — this bakes the secret into the image
ENV DATABASE_URL=postgres://user:pass@prod:5432/myapp
# Anyone who can pull the image can extract this

# Manual rotation
doppler secrets set DATABASE_URL="postgres://newuser:newpass@newhost:5432/MyApp"
doppler secrets set --config prd DATABASE_URL="postgres://..."
doppler download --format env --config prd > .env.production

# Automated rotation (AWS Secrets Manager)
aws secretsmanager rotate-secret --secret-id myapp/production
# Lambda function handles the actual credential change in the database

# Zero-downtime rotation pattern:
# 1. Deploy app that accepts BOTH old and new credentials
# 2. Rotate the secret
# 3. Deploy app that only accepts new credentials
# 4. Remove old credential