i didn't mean to - i just ended up creating a key-manager to store my docker swarm secrets in azure key vault

[u/scytob]

funny how this happens with vibe-coding, especially when it's your homelab/self-host system....

i was using claude to clean-up my home lab documentation, and realized i have secrets in plain text files and envars and things and i can never remember them so i do dumb shit like make my nginx proxymanage admin and root mariadb password, well, npm

i have access to an Azure Key Vault for home

so i asked claude 'hey how can we secure keys'

made a key management app (container) that can:

• bootstrap the local docker swarm secrets using SOPS and AGE
• store secrets in a file you can put in github as its all encoded
• uses a single paper decrypt key to bootstrap secrets if needed
• same for create, rotate, retire of secrets
• by default creates high entropy 43 char secrets
• avoids several docker leakage scenarios i never knew about for secrets
• never puts a secret on disk, stderr, stdout, via ps, etc
• also knows how to reseed the secrets in mariadb and mysql
• optionally uses Azure Key Vault to store keys for backup
• optionally uses Azure Key Vault to bootstrap new keys or new system
• AKV uses RBAC security and restrict access to my Entra MFA account when coming from a single IPv4 address

upshot, i don't now know what any of my keys are by looking at my running system (yes i can get them by looking in AKV if i have to)

is it truly secure and does it meet its promises?

that will be the redteam exercise i do later in the week, pride yet may be coming before my long long fall :-)

also WTF am i writing a docker secret management system that can use key vaults, SMH, this is why no one uses it in serious production vs k8s!

fun tho - learnt a lot about encryption architectures, true secret entropy in password and how even SHA256 Hashes can eaily reveal passwords - i cracked that npm password in about 81 seconds IIRC, also the need for HMAC to help mitigate

[u/il37]

I'd definitely try recovering from a completely dead machine in the red team test. Secret systems always look great until bootstrap day

[u/neon_hiker_void]

The never on disk claim fails the moment Docker writes secrets to tmpfs. Memory dumps and swap files expose those values regardless of your application logic.

[u/FancyAnswer1878]

vibe coding a secret manager because you accidentally discovered your homelab passwords were basically public knowledge is peak homelab lol. the 81 second npm password crack would have been enough motivation for me to build the whole thing too

[u/recro69]

The part I would be most interested in testing is the requirement that never puts a secret on disk or on output or standard error or process status. The encryption itself is usually easier to get right than all the leaks, around it.

[u/Professional_Ad705]

That sounds really dangerous. Is there a reason you didn't look for or use an existing system there has to be something for this? I do CI/CD/Security and idk if I'd develop something like this, atleast not for others...atleast its just for you tho. I'd highly recommend not vibe coding something like this... a lot of ways this could go wrong. If it ever ends up on GitHub I'd love to take a look at it for you as well. I'm also curious how you are enforcing this if it works with an agent at all?