Doppler is a secrets management company whose blog covers env files, secrets rotation, source control practices, and security lessons from incidents.
Commenters often name Doppler as a secrets manager alternative to .env files, with one user reporting use with its Kubernetes operator, though some come from the company.
Hello,
At my current gig we're using doppler[^1] (no affiliation) for application secrets. We're using doppler with their kubernetes operator which supports auto-rotation on secrets. Secrets are set as "env variables". So far, doppler has not suffer big outages or we did not notice, because the operator will keep working even if their API is down - of course you won't get updates. Access control could be more _fine grained_ and they added secret auto-rotation option recently[^2]. We don't use that yet.
I've been a happy 1Password user (no affiliation) and we use it company wide to share user secrets. 1Password support CI/CD integration IIRC, so in theory should cover most use cases.
If you can pay for AWS Vault, the terraform integration comes out of the box. However if you're a small team running vault might be a daunting task and you're inserting another SPoF.
There are many open source application secrets tools that you could check out though. In the past I had great experience with credstash[^3]. Credstash is a really simple and secure open source solution that is based on AWS KMS, IAM and DynamoDB. Costs pennies to run for medium size deployments. Once you setup and document the way to use it, it's really easy. The downside is that as a tool is pretty _raw_ you have to build things like "secret generators", etc. But combined with a slack bot can be a really powerful, secure, cost-effective self-hosted solution that doesn't require maintenance (as opposed to…
Lots of really great questions in here! Starting at the top-
The process demoed in the video is for user-based auth. Service tokens can be issued programmatically and provide read-only access to one config. You can pass these into your environment via puppet and other configuration tools, or even via LDAP, in much the same way you bootstrap other OS config like SSH keys.
I really like your thoughts around more niche access roles, and it's definitely where we're headed. Admittedly our RBAC is currently more limited with a basic Member, Admin, Owner model. We do have existing audit capabilities for monitoring secrets changes (without revealing the actual secrets) and support shipping those logs to Slack or a webhook.
Audit history is based on your specific plan[0], but we currently offer up to a year. Some customers do have requirements for longer time periods and we can easily configure that for them.
Regarding your last point, this is what we refer to as secret referencing. You can absolutely reference secrets across different configs and projects to avoid repeating common values. Here's our announcement from when we shipped this feature back in August[1].
[0] https://doppler.com/pricing
[1] https://doppler.com/changes/secrets-referencing
This post is great! I would also add using the built-in secrets store your infra provider has in staging and production. For example, Heroku has config vars.
Shamless ad: If you guys are looking for a free and easy to use secrets manager with powerful features that work on every stack, I would recommend Doppler (YC W19). For transparency, I am the CEO.
Doppler is a cloud-hosted secrets manager designed to win the heart of the developer while meeting all the requirements of your security team. It works great in local development and production, can be nearly 100% automated, and has built-in versioning, reusable configs, audit logs, SSO, granular access controls, can automatically sync with your infra provider's secrets store (ex: Heroku Config Vars). It also has high availability features built into every part of our stack (from our open-source CLI creating encrypting fallback files to our servers running on multiple infrastructures).
Feel free to create a free account (no cc required) at https://doppler.com
Doppler | Developer Advocate - Hacker News | Remote, US | Full-Time | $150-$170k + benefits
Doppler is building the future of SecretOps. We are the uncomplicated way to sync, manage, orchestrate, and rotate secrets across any environment or app config with easy-to-use tools. We have amazing investors like Google Ventures, CRV, Sequoai, YC, Greylock, and so on… we are also backed by incredible leaders from companies like Github, Vercel, Figma, OpenAI, and more.
We are looking for someone who comes from an engineering background who is passionate about Hacker News and who wants to spend their days understanding how to create content to deeply engage the Hacker News audience. This person will work very closely with our CEO, Brian Vallelunga.
You can apply here: https://www.doppler.com/careers#open-roles or reach out to Emilie.sperling@doppler.com
This seems like quite a lot of setup and hassle for what could be handled some other way with less fuss, like chamber[0] or Doppler[1]. Heck, even the classic .env seems like a better choice in every way.
What are the advantages to a configuration like this? Seems the HTTP interface with non-encrypted cache and separate agent situation isn’t something secure enough to satisfy most companies these days.
[0] https://github.com/segmentio/chamber
[1] https://www.doppler.com/
There are a ton of companies that do this as a service:
- https://www.doppler.com/ (my favorite)
- AWS Secrets Manager
- Google Cloud Secret Manager
- Azure Key Vault
- https://AKeyless.io
- https://EnvKey.com
Then, there's a few companies that do OSS solutions:
- Hashicorp Vault (https://vaultproject.io)
- CyberArk Conjur / Secretless (https://github.com/cyberark)
I'm sure there are lots that I've missed.