SOPS for secrets - has anyone tried?

[stanfrbd]

Hello there,

I was wondering how you handle Cyberbro secrets / env.

I'm planning to add a section in documentation.

How do you handle these?

I'm planning to test SOPS because it sounds like a plug and play option.

Any thoughts?

[ubahmapk]

I use 1Password to load the secrets into the environment. This is the first I've heard of SOPS.

[stanfrbd]

Interesting! I was wondering about writing a guide, with different providers.

One thing bothers me: even if I added support for .env, we still have to store the secret files for persistence in the container.

This is a big issue in case of infostealer or docker inspection, and I'm looking for ways to improve that.
It won't be easy since there is no authentication (and I prefer to rely on reverse proxies / WAF to keep Cyberbro simple).

I think we need to trust the user to use an encryption option (on his own).

Maybe it can be a good idea to introduce support for different secrets providers (well-known keyvaults and so on).

This is basically brainstorming at this point :)