Every secret in my homelab has exactly one home: how I run a self-hosted secrets manager, and the traps that bit me

说明与用途

文章描述了在家庭实验室中迁移到单一秘密管理器的过程，所有秘密存储在 Infisical 中，并通过机器身份访问。引入了解析器层、引导秘密和基于哈希的验证，以简化轮换并提高安全性。

问题

Secrets were scattered across compose files, env files, and backups, making rotation hard and stale copies likely.

结果

Secrets are now centralized, auditable, and rotatable from one place; services run without stale credentials and with scoped access.

工作流

• 1. Store all secrets in Infisical (or similar).
• 2. Create a machine identity per service with scoped access.
• 3. Deploy a tiny resolver that resolves env → vault → default.
• 4. Keep a single bootstrap credential in a tightly-permissioned env file per host.
• 5. Use SHA‑256 fingerprints to verify secrets without printing values.
• 6. Rotate secrets by updating only the vault entry.
• 7. Revoke machine identities when retiring services.
• 8. Ensure automated identities are read‑only.

证据

The test I use to know it's working is brutal and simple: can I rotate any password in the estate by changing it in exactly one place?

来源

A service read its secrets from an env_file in compose, and it restart-looped on boot with an authentication failure — using a password I could see, plainly correct, sitting right there in the file.

来源