Securing a 15-Package Monorepo in Docker: Production Secrets for Self-Hosted AI Wallets

Description and use

WAIaaS secrets are protected using Docker Secrets; the master password is stored in a 600‑permission file excluded from version control, and deployment uses a secrets overlay compose file for secure injection.

Problem

Managing production secrets for a 15‑package monorepo running in Docker, ensuring the master password never leaves the server and is not exposed via environment variables.

Outcome

Secrets are securely injected via Docker Secrets, master password never exposed, and the deployment remains healthy with built‑in healthchecks.

Workflow

• Create a secrets directory and write the master password to a file with chmod 600
• Add the secrets directory to .gitignore
• Use docker‑compose.secrets.yml overlay with docker compose -f docker-compose.yml -f docker-compose.secrets.yml up -d
• Verify deployment with docker compose logs and curl http://127.0.0.1:3100/health
• (Optional) Use auto‑provisioning to generate a recovery key, retrieve it, and set a new master password with waiaas set-master

Evidence

Environment variables in Docker have a few uncomfortable properties. They show up in docker inspect. They appear in process listings on some systems. They get logged if you're not careful. They end up in shell history. And they're visible to any process inside the container.

Source