ohai.social

Dan ⁂finally found some time to play with <a href="https://beoriginal.social/tags/SOPS" class="mention hashtag" rel="nofollow noopener" target="_blank">#SOPS</a> (<a href="https://getsops.io/docs/" rel="nofollow noopener" translate="no" target="_blank">https://getsops.io/docs/</a>) and migrated a project to it. seems like a good replacement and optimization for our current secrets sharing workflow. also super useful that it works with both <a href="https://beoriginal.social/tags/PGP" class="mention hashtag" rel="nofollow noopener" target="_blank">#PGP</a>/ <a href="https://beoriginal.social/tags/GPG" class="mention hashtag" rel="nofollow noopener" target="_blank">#GPG</a> and <a href="https://beoriginal.social/tags/age" class="mention hashtag" rel="nofollow noopener" target="_blank">#age</a> keys

Vesa-Pekka TuomaalaNyt kun oon muutaman päivän vääntäny sops-nixin ja syncthingin parissa, niin tänään vois käydä oikeesti harrastamassa liikuntaa maastopyöräilyn muodossa <a href="https://mastodontti.fi/tags/sops" class="mention hashtag" rel="nofollow noopener" target="_blank">#sops</a> <a href="https://mastodontti.fi/tags/syncthing" class="mention hashtag" rel="nofollow noopener" target="_blank">#syncthing</a> <a href="https://mastodontti.fi/tags/biketooter" class="mention hashtag" rel="nofollow noopener" target="_blank">#biketooter</a> <a href="https://mastodontti.fi/tags/Py%C3%B6r%C3%A4ilydontti" class="mention hashtag" rel="nofollow noopener" target="_blank">#Pyöräilydontti</a>

Sean HoodIt works! Taking mozilla/sops and <a href="https://hachyderm.io/tags/puppet" class="mention hashtag" rel="nofollow noopener" target="_blank">#puppet</a> <a href="https://hachyderm.io/tags/hiera" class="mention hashtag" rel="nofollow noopener" target="_blank">#hiera</a> and making them one! I do love hiera_eyaml but <a href="https://hachyderm.io/tags/sops" class="mention hashtag" rel="nofollow noopener" target="_blank">#sops</a> is just 10x better.``` $ puppet lookup --hiera_config=spec/fixtures/hiera.yaml --modulepath=~/git/hiera-sops nested::data --- thing1: - one - two thing2: - three - four ```

Soliman HindyConférence : « <a href="https://mastodon.lovetux.net/tags/SOPS" class="mention hashtag" rel="nofollow noopener" target="_blank">#SOPS</a> (de près), passez un savon à vos secrets en clair ! » <a href="https://mastodon.lovetux.net/tags/tnt25" class="mention hashtag" rel="nofollow noopener" target="_blank">#tnt25</a>

Eddie RogerAfter a few nights and weekends of mashing keys, I have figured the right order to bring up a <a href="https://hachyderm.io/tags/nixos" class="mention hashtag" rel="nofollow noopener" target="_blank">#nixos</a> instance built for <a href="https://hachyderm.io/tags/proxmox" class="mention hashtag" rel="nofollow noopener" target="_blank">#proxmox</a>, provision it with <a href="https://hachyderm.io/tags/colmena" class="mention hashtag" rel="nofollow noopener" target="_blank">#colmena</a>, shove secrets on it with <a href="https://hachyderm.io/tags/sops" class="mention hashtag" rel="nofollow noopener" target="_blank">#sops</a>, bring up a docker container, and get it on my <a href="https://hachyderm.io/@tailscale" class="u-url mention" rel="nofollow noopener" target="_blank">@tailscale</a> <a href="https://hachyderm.io/tags/tailnet" class="mention hashtag" rel="nofollow noopener" target="_blank">#tailnet</a>. I don’t know how many times I nearly gave up, but it paid off, and I’m thrilled. Now to do it again.

ShineSecrets management via <a href="https://techhub.social/tags/SOPS" class="mention hashtag" rel="nofollow noopener" target="_blank">#SOPS</a> and HashiCorp <a href="https://techhub.social/tags/Vault" class="mention hashtag" rel="nofollow noopener" target="_blank">#Vault</a>: 1. Store secrets in a Git repository as SOPS-encrypted files. 2. <a href="https://techhub.social/tags/Terraform" class="mention hashtag" rel="nofollow noopener" target="_blank">#Terraform</a> gains read access to secrets during provisioning, e.g., via Google KMS. 3. <a href="https://techhub.social/tags/Terraform" class="mention hashtag" rel="nofollow noopener" target="_blank">#Terraform</a> uses the vault_kv_secret_v2 module to inject secrets into Vault. 4. Applications consume secrets directly from Vault or through Kubernetes integration.This approach separates long-term and runtime secrets storage, enhancing <a href="https://techhub.social/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> and flexibility.

michabbb🔧 <a href="https://social.vivaldi.net/tags/Sidekick" class="mention hashtag" rel="nofollow noopener" target="_blank">#Sidekick</a> transforms bare metal <a href="https://social.vivaldi.net/tags/VPS" class="mention hashtag" rel="nofollow noopener" target="_blank">#VPS</a> into a production-ready hosting platform for streamlined <a href="https://social.vivaldi.net/tags/DevOps" class="mention hashtag" rel="nofollow noopener" target="_blank">#DevOps</a>🚀 Key Features: • Single-command VPS setup integrating <a href="https://social.vivaldi.net/tags/Docker" class="mention hashtag" rel="nofollow noopener" target="_blank">#Docker</a>, <a href="https://social.vivaldi.net/tags/Traefik" class="mention hashtag" rel="nofollow noopener" target="_blank">#Traefik</a>, and <a href="https://social.vivaldi.net/tags/SOPS" class="mention hashtag" rel="nofollow noopener" target="_blank">#SOPS</a> encryption • Zero-downtime deployments with high availability and load balancing • Automatic SSL certificate management with <a href="https://social.vivaldi.net/tags/sslip" class="mention hashtag" rel="nofollow noopener" target="_blank">#sslip</a>.io support • Secure secrets management through encrypted environment files💻 Technical Highlights: • Runs on Ubuntu LTS systems • Requires only SSH key access and public IP • Supports preview environments tied to git commits • Direct container deployment from Dockerfiles💪 Platform Benefits: • Escape vendor lock-in • Affordable hosting ($8/month DigitalOcean instance) • Simple CLI-based management • Built-in security best practicesSource: <a href="https://github.com/MightyMoud/sidekick" rel="nofollow noopener" translate="no" target="_blank">https://github.com/MightyMoud/sidekick</a>

David Guillot📣 New <a href="https://social.tchncs.de/tags/webdev" class="mention hashtag" rel="nofollow noopener" target="_blank">#webdev</a> related blog post here, introducing my take on what a <a href="https://social.tchncs.de/tags/Django" class="mention hashtag" rel="nofollow noopener" target="_blank">#Django</a> project template could be for an advanced usage. Obviously <a href="https://social.tchncs.de/tags/astraluv" class="mention hashtag" rel="nofollow noopener" target="_blank">#astraluv</a> is there, but also <a href="https://social.tchncs.de/tags/justsystems" class="mention hashtag" rel="nofollow noopener" target="_blank">#justsystems</a> , <a href="https://social.tchncs.de/tags/esbuild" class="mention hashtag" rel="nofollow noopener" target="_blank">#esbuild</a> , and... <a href="https://social.tchncs.de/tags/SOPS" class="mention hashtag" rel="nofollow noopener" target="_blank">#SOPS</a> 🔐 It's very early stage so please tell me what do you think about it 🙏<a href="https://david.guillot.me/en/posts/tech/proposal-for-a-django-project-template/" rel="nofollow noopener" translate="no" target="_blank">https://david.guillot.me/en/posts/tech/proposal-for-a-django-project-template/</a>

Benedikt Ritter (he/him)I made my first contribution to a Go project today! 🎉 <a href="https://github.com/cromefire/fritzbox-cloudflare-dyndns/pull/31" rel="nofollow noopener" translate="no" target="_blank">https://github.com/cromefire/fritzbox-cloudflare-dyndns/pull/31</a> This is going to make it easier to specify secrets in my home lab setup using sops. <a href="https://chaos.social/tags/GoLang" class="mention hashtag" rel="nofollow noopener" target="_blank">#GoLang</a> <a href="https://chaos.social/tags/HomeLab" class="mention hashtag" rel="nofollow noopener" target="_blank">#HomeLab</a> <a href="https://chaos.social/tags/NixOS" class="mention hashtag" rel="nofollow noopener" target="_blank">#NixOS</a> <a href="https://chaos.social/tags/sops" class="mention hashtag" rel="nofollow noopener" target="_blank">#sops</a>

dereulenspiegelMaybe interesting for some: I built a small little tool which makes your secrets on <a href="https://chaos.social/tags/nixos" class="mention hashtag" rel="nofollow noopener" target="_blank">#nixos</a> (i.e. managed by sops-nix) available as <a href="https://chaos.social/tags/podman" class="mention hashtag" rel="nofollow noopener" target="_blank">#podman</a> secrets. <a href="https://github.com/dereulenspiegel/nix-podman-secrets" rel="nofollow noopener" translate="no" target="_blank">https://github.com/dereulenspiegel/nix-podman-secrets</a> <a href="https://chaos.social/tags/nix" class="mention hashtag" rel="nofollow noopener" target="_blank">#nix</a> <a href="https://chaos.social/tags/sops" class="mention hashtag" rel="nofollow noopener" target="_blank">#sops</a>

ShineThe best thing in <a href="https://techhub.social/tags/SOPS" class="mention hashtag" rel="nofollow noopener" target="_blank">#SOPS</a> is its awesome integration into <a href="https://techhub.social/tags/Terraform" class="mention hashtag" rel="nofollow noopener" target="_blank">#Terraform</a> stack: sops_decrypt_file -> yamldecode, and you have your variables available in the scope right away.

Morten LinderudOkay, <a href="https://chaos.social/tags/sops" class="mention hashtag" rel="nofollow noopener" target="_blank">#sops</a> gives me a datakey to encrypt. I have an ECDSA key and <a href="https://chaos.social/tags/sops" class="mention hashtag" rel="nofollow noopener" target="_blank">#sops</a> doesn't give me any medium for a shared secret where I can do ECDH.Do I yolo it and include a session key inside the ciphertext (which is what the age ciphertext does) or is there a more clever way?<a href="https://chaos.social/tags/cryptography" class="mention hashtag" rel="nofollow noopener" target="_blank">#cryptography</a> <a href="https://chaos.social/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a>

Filip 🌱 🦀<a href="https://mastodon.online/@sebhoss" class="u-url mention" rel="nofollow noopener" target="_blank">@sebhoss</a> im alone, but i want the repo to be public and i want to be able to rotate secrets decently easy. Cluster management will be done with <a href="https://infosec.exchange/tags/Flux" class="mention hashtag" rel="nofollow noopener" target="_blank">#Flux</a>, and hosting will be on bare metal, outside of the big players - i.e. AWS, Azure. Do you think <a href="https://infosec.exchange/tags/SOPS" class="mention hashtag" rel="nofollow noopener" target="_blank">#SOPS</a> is fine in this case?<a href="https://infosec.exchange/tags/FluxCD" class="mention hashtag" rel="nofollow noopener" target="_blank">#FluxCD</a>

Filip 🌱 🦀I am suffering from decision paralysis, because I have no idea if I should use <a href="https://infosec.exchange/tags/SOPS" class="mention hashtag" rel="nofollow noopener" target="_blank">#SOPS</a> for my secrets or if it will be a better idea to use <a href="https://infosec.exchange/tags/ExternalSecrets" class="mention hashtag" rel="nofollow noopener" target="_blank">#ExternalSecrets</a> with <a href="https://infosec.exchange/tags/Bitwarden" class="mention hashtag" rel="nofollow noopener" target="_blank">#Bitwarden</a> <a href="https://infosec.exchange/tags/SecretsManager" class="mention hashtag" rel="nofollow noopener" target="_blank">#SecretsManager</a>… Any <a href="https://infosec.exchange/tags/DevOps" class="mention hashtag" rel="nofollow noopener" target="_blank">#DevOps</a> engineers that are kind enough to help with advice?<a href="https://infosec.exchange/tags/k8s" class="mention hashtag" rel="nofollow noopener" target="_blank">#k8s</a> <a href="https://infosec.exchange/tags/k3s" class="mention hashtag" rel="nofollow noopener" target="_blank">#k3s</a> <a href="https://infosec.exchange/tags/kubernetes" class="mention hashtag" rel="nofollow noopener" target="_blank">#kubernetes</a> <a href="https://infosec.exchange/tags/BitwardenSM" class="mention hashtag" rel="nofollow noopener" target="_blank">#BitwardenSM</a> <a href="https://infosec.exchange/tags/BitwardenSecretsManager" class="mention hashtag" rel="nofollow noopener" target="_blank">#BitwardenSecretsManager</a>

Matic RupnikFinally got to finishing this sack of words. Have a read if you will:<a href="https://mrupnikm.github.io/en/posts/helm-sops-secrets/" rel="nofollow noopener" translate="no" target="_blank">https://mrupnikm.github.io/en/posts/helm-sops-secrets/</a><a href="https://mastodon.social/tags/sops" class="mention hashtag" rel="nofollow noopener" target="_blank">#sops</a> <a href="https://mastodon.social/tags/helm" class="mention hashtag" rel="nofollow noopener" target="_blank">#helm</a> <a href="https://mastodon.social/tags/kubernetes" class="mention hashtag" rel="nofollow noopener" target="_blank">#kubernetes</a> <a href="https://mastodon.social/tags/argocd" class="mention hashtag" rel="nofollow noopener" target="_blank">#argocd</a>

\LuXaSHier j'ai encore plus automatisé le déploiement de mon espace de travail (perso ou boulot) en ajoutant la gestion de mes secrets dans <a href="https://social.gnieh.org/tags/HM" class="mention hashtag" rel="nofollow noopener" target="_blank">#HM</a> via <a href="https://social.gnieh.org/tags/sops" class="mention hashtag" rel="nofollow noopener" target="_blank">#sops</a>-nix et <a href="https://social.gnieh.org/tags/age" class="mention hashtag" rel="nofollow noopener" target="_blank">#age</a>. C'est beau. <a href="https://social.gnieh.org/tags/nix" class="mention hashtag" rel="nofollow noopener" target="_blank">#nix</a>

Benedikt Ritter (he/him)<a href="https://chaos.social/@britter/112630897963141266" rel="nofollow noopener" translate="no" target="_blank">https://chaos.social/@britter/112630897963141266</a>On the bright side: I‘ve sops now working with sops-nix. Took a while to get all the pieces together and fix all the typos in the yaml files (did I already say I hate yaml?) <a href="https://chaos.social/tags/sops" class="mention hashtag" rel="nofollow noopener" target="_blank">#sops</a> <a href="https://chaos.social/tags/nix" class="mention hashtag" rel="nofollow noopener" target="_blank">#nix</a> <a href="https://chaos.social/tags/nixos" class="mention hashtag" rel="nofollow noopener" target="_blank">#nixos</a> <a href="https://chaos.social/tags/HomeLab" class="mention hashtag" rel="nofollow noopener" target="_blank">#HomeLab</a> <a href="https://chaos.social/tags/SelfHost" class="mention hashtag" rel="nofollow noopener" target="_blank">#SelfHost</a>

Lennart J. Kurzweg 🇪🇺For all the <a href="https://ieji.de/tags/sops" class="mention hashtag" rel="nofollow noopener" target="_blank">#sops</a> <a href="https://ieji.de/tags/nix" class="mention hashtag" rel="nofollow noopener" target="_blank">#nix</a> enjoyers out there, Where do you keep your <a href="https://ieji.de/tags/AGE" class="mention hashtag" rel="nofollow noopener" target="_blank">#AGE</a> key? Does it just live on your drive? Do you use something like a <a href="https://ieji.de/tags/yubikey" class="mention hashtag" rel="nofollow noopener" target="_blank">#yubikey</a>? Because boot strapping the key with sops obviously doesn't work<a href="https://ieji.de/tags/nixos" class="mention hashtag" rel="nofollow noopener" target="_blank">#nixos</a> <a href="https://ieji.de/tags/homemanager" class="mention hashtag" rel="nofollow noopener" target="_blank">#homemanager</a> <a href="https://ieji.de/tags/sopsnix" class="mention hashtag" rel="nofollow noopener" target="_blank">#sopsnix</a>

Lennart J. Kurzweg 🇪🇺Learning how to create <a href="https://ieji.de/tags/ssh" class="mention hashtag" rel="nofollow noopener" target="_blank">#ssh</a> keys from my <a href="https://ieji.de/tags/gpg" class="mention hashtag" rel="nofollow noopener" target="_blank">#gpg</a> <a href="https://ieji.de/tags/pgp" class="mention hashtag" rel="nofollow noopener" target="_blank">#pgp</a> keys so that I can use <a href="https://ieji.de/tags/age" class="mention hashtag" rel="nofollow noopener" target="_blank">#age</a> for <a href="https://ieji.de/tags/sops" class="mention hashtag" rel="nofollow noopener" target="_blank">#sops</a> <a href="https://ieji.de/tags/sops" class="mention hashtag" rel="nofollow noopener" target="_blank">#sops</a>-nix so I don't have to enter my email password manually if I even were to nuke my system <a href="https://ieji.de/tags/NixOS" class="mention hashtag" rel="nofollow noopener" target="_blank">#NixOS</a> <a href="https://ieji.de/tags/homemanager" class="mention hashtag" rel="nofollow noopener" target="_blank">#homemanager</a> <a href="https://ieji.de/tags/cryptograpy" class="mention hashtag" rel="nofollow noopener" target="_blank">#cryptograpy</a>

mcdwayne<a href="https://mastodon.social/tags/SOPS" class="mention hashtag" rel="nofollow noopener" target="_blank">#SOPS</a> is a very interesting technology that, when used consistenly across an org, can go a long way towards stopping secrets sprawl. Basically, agree with your team on an encryption method and SOPS does the rest! <a href="https://buff.ly/3VsEE1B" rel="nofollow noopener" translate="no" target="_blank">https://buff.ly/3VsEE1B</a>

Recent searches

Search options

Administered by:

Server stats:

#SOPS

Recent searches

Search options

Administered by:

Server stats:

SOPs

#SOPS