search

rabblerouser / infra

Code for spinning up Rabble Rouser infrastructure and provisioning the app.
https://rabblerouser.team
GNU Affero General Public License v3.0
0 stars 2 forks source link

Hide secrets from log files #1

Closed camjackson closed 7 years ago

camjackson commented 7 years ago

At the moment all variables end up in the deployment logs in plaintext, including things like the database credentials and session secret.

This is especially a problem if the code is running from a public-facing CI pipeline (e.g. snap).

camjackson commented 7 years ago

This has been fixed in two ways:

  1. App deployments are now done using the docker provider, which doesn't spew its arguments to stdout. Previously we installed apps using ansible, and the local provisioner resource would log the full ansible command, including sensitive environment variables
  2. There are still some cases where the docker TLS auth stuff is logged, but the tf script now pipes all output via sed, which strips those out.

It's not a particularly robust script, as the sed command would need to be updated for any new secrets, but it works for now.