Keep secrets in a secrets store

How to do it

Use a store such as HashiCorp Vault, AWS Secrets Manager or your host's encrypted settings. On a single server, a root-only file or systemd credentials will do. Give each secret an owner and a rotation date at most 90 days ahead, and rotate at once after a leak. Automate it where the store can, as rotate secrets automatically says. See secrets out of code for keeping them out of the repository. See also let CI sign in with OIDC and keep secrets out of state.

Example

# systemd: the secret reaches the service as a file, never in its environment listing
[Service]
LoadCredential=db-password:/etc/shop/db-password

// Node.js: systemd puts each credential in a private folder
import { readFileSync } from 'node:fs';
import path from 'node:path';

const dbPassword = readFileSync(path.join(process.env.CREDENTIALS_DIRECTORY, 'db-password'), 'utf8').trim();

from pathlib import Path
import os

db_password = (Path(os.environ["CREDENTIALS_DIRECTORY"]) / "db-password").read_text().strip()

How to check

A secret scanner finds no secret in the repository or the build output. Every secret in the store shows an owner and a rotation date that has not passed.