I generally keep my config files stored in the GitHub repo for version control, and then actual secrets are pulled dynamically from a secret store.
Secret store? Mind sharing links on what that means? I assume it's something you can self host?
Specifically AWS secrets manager, I know there's others like if you're using Ansible there's Ansible Vault. The point is that it's a separate service that keeps all your secrets encrypted at rest and to access them you need an initial authentication.
I've been meaning to get the ansible thing. Not for my home computers, my dotfiles are on GitHub, SSH keys offline, stuff backed up. But I always think that if my poor hetzner box dies, I'll have a lot of fun getting it all back up :/
๐ Honestly Ansible can be a little obtuse at times, I'm having a much better time with having all my stuff defined in Docker and deployed via docker-compose or Terraform for non-self-hosted stuff. Ansible can be a lot of effort but I can also see it being better in the long run.
Then there's the NixOS people.. people swear by that. I haven't dived into that whole world yet.
Yeah NixOS is my other alternative, but I think that rabbit hole is much more deep than the Ansible one :)
I also manage my few self-hosted things and play-things with docker-compose on my box, but who manages docker-compose files? :) And nginx config, and network-related stuff etc etc. I am too lazy but I guess I will have to bite the bullet and after 20 years of manually doing it all and backing up raw and praying, actually figuring out the next level.
Go ahead and graduate to etckeeper if you're targeting /etc
Never knew about this tool, good to know!
A good tip for setting up a tool to automate this process.
I tend to make a .bak file before changes. There is nothing worse than fixing one config item only to realize later something else broke and not being sure what it was that changed and no easy way to revert. I'm guilty of having many .bak configs that are poorly named. I hadn't heard of etckeeper before. That looks real handy for me. Thanks for sharing
Some Zsh:
bak () {
emulate -L zsh
for 1 {
cp -i $1 $1.bak
ls -l $1 $1.bak
}
}
This is a clean way to make your own new command called 'bak', to automate making a second copy of the file.
Whether you're a seasoned pro or the noobiest of noobs, you've found the right place for Linux support and information. With a dedication to supporting free and open source software, this community aims to ensure Linux fits your needs and works for you. From troubleshooting to tutorials, practical tips, news and more, all aspects of Linux are warmly welcomed. Join a community of like-minded enthusiasts and professionals driving Linux's ongoing evolution.