How do you put the key to the production environment:.env Documentation authority, rotation and disclosure processing

Environmental variables are a mode of transmission, not a security level.

Move password from code to code .env It's progress, but it doesn't mean it's automatically secure. Git, back-up, mirror-building context, process environment, or debugging logs. First you divide the information into three categories: open configuration, internal but not sensitive configuration, and immediately rotate the secret after disclosure. Only the third category requires key management. Typical secrets include database passwords, session signature keys, third parties. API token, SMTP password and private key. Domain name, log level, public site URL Often it is not a secret, and it is not necessary to hide all the configurations to add to the difficulties of error.

Create a list of keys that do not contain values

List records names, uses, uses services, owners, sources, creation times, rotation cycles, and withdrawals, and does not record real values. API token The leaks affect which processes and also identify documents that are long overdue but still valid. Different certificates are used for development, testing and production. Do not treat long-term keys generated from personal accounts as permanent assets of the server; do not use the exclusive administrator key if you can use the service account number and minimum privileges.

There are clear rules for the location and permission of files.

systemd Available /etc/myapp/myapp.env# Through # EnvironmentFile reading;files by root Management, application group read-only.Compose It's... env_file It should also be placed outside the deployment directory or severely restricted and added .gitignore with construction ignores.

sudo install -d -m 750 -o root -g myapp /etc/myapp
sudo install -m 640 -o root -g myapp /private/path/myapp.env /etc/myapp/myapp.env
sudo -u myapp test -r /etc/myapp/myapp.env

Do not paste values directly in shared chats, command history, and screenshots. Use access control mode for editing; check after completion shell history and temporary files. If the backup contains a key, the backup itself is encrypted and restricted in access.

The container environment requires additional inspection.

Don't be here. Dockerfile Use ARG or ENV The bakery production secret, which may remain in mirror layers and build records.Compose Environmental variables are suitable for general configuration; for highly sensitive content, consideration is given to file mount or platform provision secrets mechanism, which allows the application to be read from a restricted file. Either way, the process within the container with the corresponding permissions may still be read and the minimum permission and process separation cannot be avoided. Implementation docker compose config . The health check and bug processing cannot show the complete connection.

The rotation is designed to be two keys that will coexist briefly.

Direct replacement of a database password or signature key may cause the old process to be disconnected or all users to exit immediately. Systems that can be certified by two keys first add new keys, deploy and authenticate, and then undo the old key; no two-key window can be arranged, backups, updates the service, restarts the consumer one by one, and finally validates that the old key is no longer valid. The session sign key rotation may invalidate the existing login and accept this impact in advance. Database users can create a new account and switch connections, confirming that there is no old connection, and then delete the old account number. The rotation finishes by updating the list date, not simply changing the file.

If you suspect a leak, drop it first. Don't start with anyone.

The order of processing is: limit the range of impacts, withdraw or rotate, check unusual usage, fix leak routes, re-repair disks only. Git History is not sufficient to remove strings because old submissions and cloning are still possible to preserve; true keys must be considered exposed. Keep the time line: When you find out what services are used, when you cancel them, and whether there are any irregularities in the log.CI Logs and mirror warehouses are checked.

Completion criteria

The warehouse and mirrors do not contain production secrets, the service reads controlled files with minimal permission, develops separate from production certificates, logs do not return to visible values, each secret has a responsible person and is withdrawn, and has completed at least one rotation exercise.Database backup and recovery exercises.