Securing a 15-Package Monorepo in Docker: Production Secrets for Self-Hosted AI Wallets

Описание и применение

Секреты WAIaaS защищаются с помощью Docker Secrets, master‑пароль хранится в файле с правами 600 и не попадает в репозиторий. Автоматический развертывание через docker‑compose.secrets.yml обеспечивает безопасный ввод секретов.

Задача

Managing production secrets for a 15‑package monorepo running in Docker, ensuring the master password never leaves the server and is not exposed via environment variables.

Результат

Secrets are securely injected via Docker Secrets, master password never exposed, and the deployment remains healthy with built‑in healthchecks.

Рабочий процесс

• Create a secrets directory and write the master password to a file with chmod 600
• Add the secrets directory to .gitignore
• Use docker‑compose.secrets.yml overlay with docker compose -f docker-compose.yml -f docker-compose.secrets.yml up -d
• Verify deployment with docker compose logs and curl http://127.0.0.1:3100/health
• (Optional) Use auto‑provisioning to generate a recovery key, retrieve it, and set a new master password with waiaas set-master

Доказательства

Environment variables in Docker have a few uncomfortable properties. They show up in docker inspect. They appear in process listings on some systems. They get logged if you're not careful. They end up in shell history. And they're visible to any process inside the container.

Источник