I don’t mean certs for HTTPs but for third party services (eg: databases). Typically I use env vars for passwords and DB URLs, but with cert files there’s always issues with line breaks and how to parse the strings. Would be great if fly secrets set could use a .crt file (or any text file really) …

[image] sudhir.j: I wonder if there’s a secrets service (like Hashicorp Vault) one could mount as a filesystem, that would be interesting for this kind of thing. Google Cloud Secrets does this. You can either mount a secret in the filesystem in a certain path (at least in Google Cloud Run), …

Oh, that makes sense. Google Cloud also do a lot of key based secrets as part of the offering itself (think most service & API keys are files), so it makes sense they’ve got first class support for this. I’ll put this in as a feature request… how are you managing right now, though? Just setting sec…

[image] sudhir.j: I’ll put this in as a feature request… how are you managing right now, though? Just setting secrets with escaped newlines / base encoding / copying them into the image? Awesome! Honestly, I rarely need to use certs and get by with simple env vars. Recently I started using …

Sorry I don’t follow: Why would one need a vault when fly secrets itself can be that vault? We have a similar use to include private cert to handle TLS termination inside our fly app, and are just now looking at ways to do so. Of course, we would simply let fly do TLS termination, but we need the …

I’d assume piping them in would work like cat stuff.env | fly secrets import but let me double check and get back to you. That pretty much works as a way to import a .env file.

The vault works fine, it’s more the mechanism of providing the secret to the running application. With certain formats (especially certification files with lots of newlines) it’s more convenient to have it as files on the disk instead of environment variables — mostly because to set them you’ll nee…

Thanks that did it! cat .env | fly secrets import Would be great if you added this to your secrets docs :slight_smile:

Oh, good. Will update the docs.

Every few months I need to search for this answer. [image] Read secrets from .env file This command works, but better write it down… cat .env | tr '\n' ' ' | xargs flyctl secrets set

Just found out there’s also flyctl secrets set FROM_A_FILE=- < file.txt which should actually work much better for certificates or newline-y files.

How are you managing cert files with Fly?

Questions / Help

michael October 29, 2021, 8:39pm 11

Every few months I need to search for this answer.