{"action":"created","issue":{"url":"https://api.github.com/repos/NixOS/nixops/issues/942","repository_url":"https://api.github.com/repos/NixOS/nixops","labels_url":"https://api.github.com/repos/NixOS/nixops/issues/942/labels{/name}","comments_url":"https://api.github.com/repos/NixOS/nixops/issues/942/comments","events_url":"https://api.github.com/repos/NixOS/nixops/issues/942/events","html_url":"https://github.com/NixOS/nixops/issues/942","id":320044719,"number":942,"title":"Secure Persistant Storage of Digital Ocean Auth Keys","user":{"login":"ixxie","id":20320695,"avatar_url":"https://avatars0.githubusercontent.com/u/20320695?v=4","gravatar_id":"","url":"https://api.github.com/users/ixxie","html_url":"https://github.com/ixxie","followers_url":"https://api.github.com/users/ixxie/followers","following_url":"https://api.github.com/users/ixxie/following{/other_user}","gists_url":"https://api.github.com/users/ixxie/gists{/gist_id}","starred_url":"https://api.github.com/users/ixxie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ixxie/subscriptions","organizations_url":"https://api.github.com/users/ixxie/orgs","repos_url":"https://api.github.com/users/ixxie/repos","events_url":"https://api.github.com/users/ixxie/events{/privacy}","received_events_url":"https://api.github.com/users/ixxie/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-05-03T19:12:37Z","updated_at":"2018-05-08T19:31:17Z","closed_at":null,"author_association":"NONE","body":"Quoting the Digital Ocean chapter of the NixOps manual on how to store the authentication token for the Digital Ocean backend:\r\n\r\n> [..] have the `DIGITAL_OCEAN_AUTH_TOKEN` set with an authentication token, obtained from the Digital Ocean console. The token can also be provided via the `deployment.digitalOcean.authToken` option. \r\n\r\nI am no security guru, but this strikes me as a little insecure? I am wondering how to persist the environment variable or configuration option in a more secure way; are there best practices or tools that allow me to avoid having to store my authentication token in the clear?"},"comment":{"url":"https://api.github.com/repos/NixOS/nixops/issues/comments/387516127","html_url":"https://github.com/NixOS/nixops/issues/942#issuecomment-387516127","issue_url":"https://api.github.com/repos/NixOS/nixops/issues/942","id":387516127,"user":{"login":"ixxie","id":20320695,"avatar_url":"https://avatars0.githubusercontent.com/u/20320695?v=4","gravatar_id":"","url":"https://api.github.com/users/ixxie","html_url":"https://github.com/ixxie","followers_url":"https://api.github.com/users/ixxie/followers","following_url":"https://api.github.com/users/ixxie/following{/other_user}","gists_url":"https://api.github.com/users/ixxie/gists{/gist_id}","starred_url":"https://api.github.com/users/ixxie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ixxie/subscriptions","organizations_url":"https://api.github.com/users/ixxie/orgs","repos_url":"https://api.github.com/users/ixxie/repos","events_url":"https://api.github.com/users/ixxie/events{/privacy}","received_events_url":"https://api.github.com/users/ixxie/received_events","type":"User","site_admin":false},"created_at":"2018-05-08T19:31:17Z","updated_at":"2018-05-08T19:31:17Z","author_association":"NONE","body":"@nh2 makes a lot of sense; I would find a nice compromise between security and convenience would be to encrypt all the keys for NixOps using one password; a password is certainly easier to memorize than an authentication key!\r\n\r\nI imagine it would be difficult to implement as a feature, but reasonable to implement for a personal configuration, by - for example - encrypting a `/secrets` folder. I guess the tricky bit is finding a convenient way to 'wrap' the `nixops` CLI with the decryption logic."}}
{"actor":{"display_login":"ixxie"}}