Self-hosted secrets managers compared
Which self-hosted secrets manager belongs on one VPS: OpenBao, Infisical, SOPS with age, systemd credentials, or a locked down env file, and what each costs.
#secrets
Filtering by topic #secrets · clear
Keep secrets out of your AI agents
An agent holding your API keys can leak them in one tool call. Give it scoped short lived tokens behind a credential gateway, never the real keys.
Coding agent telemetry: what gets sent
Four kinds of traffic leave a coding agent, and only one is unavoidable. Audit any agent from the machine itself, then cut the traffic you did not agree to.
Ansible Vault: encrypt secrets in git
Keep passwords and API tokens in a playbook repo safely: encrypt a vars file or one inline string, split staging from production, and rekey cleanly.
Docker Compose env files and secrets
Three different things get called an env file in Docker Compose. See how .env, env_file and environment differ, which one wins, and where secrets belong.