[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [EXT] Re: Medium-term road map

From: Jack Hill
Subject: Re: [EXT] Re: Medium-term road map
Date: Wed, 6 May 2020 15:46:17 -0400 (EDT)
User-agent: Alpine 2.20 (DEB 67 2015-01-07)


On Wed, 6 May 2020, Thompson, David wrote:

On Sat, Apr 25, 2020 at 5:38 PM Jack Hill <address@hidden> wrote:

* Continued development of guix deploy. Figuring out how to deploy secrets
to remote machines would be great.

I used to think this was a problem that guix deploy had to deal with
but after many years doing devops full-time I no longer think this is
a concern. Industry best practice is to use a secrets management
service to fetch secrets at application boot time.  For example, you
could write a shepherd service that downloads and installs an SSH host
key from AWS Secrets Manager (or a self-hosted free tool or another
cloud provider's service, you get the idea) before the SSH service
starts.  In my experience, every application requires a slightly
different strategy: Maybe you need to put a key into a specific file,
maybe you need to set environment variables, maybe you need to
templatize the config file, etc. There's no single general solution to
the problem, but I strongly the believe that the guix client that is
doing the deployment should never access such secrets.

Good idea, thanks for sharing. That sounds like a reasonable path forward to me. However, …

Long story short: Guix need not worry about this.

I think we may want to do some work in Guix to support this workflow conveniently. That work could include having a secrets management service, bootstrapping new hosts for access to the service, or writing system services that can be easily configured for different secret management at deploy time. It's fun to think about what we could do, but as Ludo’ suggested elsewhere in the thread, we'll find out by trying to deploy more hosts with more complex configurations. I hope to be able to do so soon.


reply via email to

[Prev in Thread] Current Thread [Next in Thread]