Reading app secrets locally

[lubien]

@can3p

What’s the fly stance on this?

Thomas explained it better here:

Why is `fly secrets list` not showing the values?

Our API doesn’t have access to the contents of secrets. When you set a secret through the API, we seal it in a software HSM, to which our API server has no access (we currently store an authenticator tag of the secret so you can match them up between apps, but I’m dubious about the value of this feature and lobbying to get rid of it). You can, of course, recover secrets by SSH’ing into an app, or, for that matter, deploying a new version of your code that simply logs the secret in plaintext; at…

@can3p

If using the secrets from fly locally is discouraged, what would be your recommendation on how to perform these tasks?

it’s fine making those scripts, really! We aim to make it more difficult for anyone get those secrets but the right people (read: ACL) in your organization will still be able to use them.