Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Storing deployment key as secret environment variable? #348

Open
peterjc opened this issue Jun 17, 2019 · 3 comments
Open

Storing deployment key as secret environment variable? #348

peterjc opened this issue Jun 17, 2019 · 3 comments

Comments

@peterjc
Copy link

peterjc commented Jun 17, 2019

There is some interesting (historical) background on #242 and #276 about deployment keys and where to store them in order to support multiple deployments from a single repository, and #166 is close to my request.

Rather than the current token or fernet encryption solutions, could doctr simply have the private deploy key itself as a secret environment variable? i.e. Define the variable(s) in TravisCI Repository Settings and turn on hide in logs (should be able to do something similar on other platforms too):

https://docs.travis-ci.com/user/environment-variables/#defining-variables-in-repository-settings

This fits with the TravisCI advice at the start of that page:

  • if it does contain sensitive information, and might be different for different branches – encrypt it and add it to your .travis.yml
  • if it does contain sensitive information, but is the same for all branches – add it to your Repository Settings

All we need to tell doctr is the name of the environment variable it can find the deployment key in (from where it can do the SSH setup), to further reduce the chance of the environment variable appearing in a log despite TravisCI's efforts to censor it.

I would also add that avoiding having (an encrypted copy) of the key in your .travis.yml file and/or as *.enc in the repository has another big plus - the basic configuration can be shared or changed between forks without any conflicts (e.g. setting up a personal fork of a project repo and the deployment repo).

@asmeurer
Copy link
Member

I think I initially thought the key was too big to fit in an environment variable. Or maybe there really was such a size limitation, I can't remember.

I can't remember if there was some other disadvantage to doing this. I think it mostly just hasn't happened because I never got around to implementing it. It's my "option 3" from #242

@peterjc
Copy link
Author

peterjc commented Jun 17, 2019

Good to hear.

If there’s no obvious technical reason not to try doing it this way, I think it would make for a simpler system (especially for thinks like experiments on a personal fork before deploying to the master repository).

I may have a go, having failed to get things to work with the encrypted key approach.

@asmeurer
Copy link
Member

Great. Unfortunately doctr requires a lot of manual testing, especially anything related to the configure stage, so it requires some time dedication to work on things, which I haven't had lately. But if you want to help work on things great. I can give you push access if it will help.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants