Skip to content

Secrets Management

slipp integrates with Ansible Vault for secure secret management. Generate secrets, store them encrypted, and use them in deployments and local development.

Quick Start

Section titled “Quick Start”

  1. Generate a secret

    Terminal window
    slipp secret
    # Output: 64 hex chars (256-bit)

  2. Add to vault

    Terminal window
    slipp secrets add vault_db_password myproject

  3. Use in templates

    group_vars/all.yml
    database_password: "{{ vault_db_password }}"

  4. Encrypt vault

    Terminal window
    ansible-vault encrypt inventory/host_vars/myhost/vault.yml

Generating Secrets

Section titled “Generating Secrets”

Basic secret

Section titled “Basic secret”
Terminal window
slipp secret

Output: 64 hex characters (256-bit entropy)

Options

Section titled “Options”
Terminal window
# 16 bytes (128-bit)
slipp secret --bytes 16


# 64 bytes (512-bit)
slipp secret --bytes 64

Managing Vaults

Section titled “Managing Vaults”

List available vaults

Section titled “List available vaults”
Terminal window
slipp secrets list

Shows all registered projects with vault files:

Available vaults:
project      vault                    secrets
myproject    inventory/.../vault.yml  5
auth-service inventory/.../vault.yml  3

List secrets in a vault

Section titled “List secrets in a vault”
Terminal window
slipp secrets list myproject
Secrets in inventory/host_vars/myhost/vault.yml:
  - vault_db_password
  - vault_api_key
  - vault_jwt_secret

Get template string

Section titled “Get template string”
Terminal window
slipp secrets list myproject vault_db_password
# Output: {{ vault_db_password }}

Adding Secrets

Section titled “Adding Secrets”

Add random secret

Section titled “Add random secret”
Terminal window
slipp secrets add vault_db_password myproject

Generates a random secret and adds it to the vault.

Add JWK keypair

Section titled “Add JWK keypair”
Terminal window
slipp secrets add vault_signing_key myproject --jwk

Generates an RSA keypair for JWT signing.

Custom entropy

Section titled “Custom entropy”
Terminal window
slipp secrets add vault_session_key myproject --bytes 64

Syncing Secrets

Section titled “Syncing Secrets”

Auto-generate secrets for all {{ vault_* }} references:

Terminal window
slipp secrets sync inventory/host_vars/myhost/vars.yml
  1. Scans the YAML file for {{ vault_* }} patterns
  2. Lists found references
  3. Generates random secrets for each
  4. Creates vault.yml in the same directory

Using Secrets

Section titled “Using Secrets”

In Ansible templates

Section titled “In Ansible templates”

Reference vault secrets in your vars files:

group_vars/all.yml
database:
  password: "{{ vault_db_password }}"


api:
  secret_key: "{{ vault_api_key }}"

In run profiles

Section titled “In run profiles”

Load vault secrets as environment variables:

Terminal window
slipp run dev --vault myproject --cmd "npm run dev"

Secrets are transformed and injected:

  • vault_db_password becomes DB_PASSWORD
  • vault_api_key becomes API_KEY

Multiple vaults

Section titled “Multiple vaults”

Combine secrets from multiple projects:

Terminal window
slipp run dev --vault myproject --vault shared-secrets

Vault Workflow

Section titled “Vault Workflow”

Initial setup

Section titled “Initial setup”

  1. Create vars file with references

    inventory/host_vars/myhost/vars.yml
    matrix_sliding_sync_shared_secret: "{{ vault_sliding_sync_secret }}"
    matrix_postgres_connection_password: "{{ vault_postgres_password }}"

  2. Generate secrets

    Terminal window
    slipp secrets sync inventory/host_vars/myhost/vars.yml

  3. Encrypt vault

    Terminal window
    ansible-vault encrypt inventory/host_vars/myhost/vault.yml

  4. Deploy

    Terminal window
    slipp deploy
    # Prompts for vault password

Adding new secrets

Section titled “Adding new secrets”

  1. Add to vault

    Terminal window
    slipp secrets add vault_new_secret myproject

  2. Reference in vars

    new_service_key: "{{ vault_new_secret }}"

  3. Redeploy

    Terminal window
    slipp deploy

Pulling from External Sources

Section titled “Pulling from External Sources”

Pull credentials from external services via browser-based approval.

How It Works

Section titled “How It Works”

  1. Start pull

    Terminal window
    slipp secrets pull nor-auth myproject

  2. Browser opens for authentication and resource selection

  3. Approve the credential export in your browser

  4. Credentials stored encrypted in your vault

nor-auth Integration

Section titled “nor-auth Integration”

Pull bot credentials and API keys from nor-auth console:

Terminal window
slipp secrets pull nor-auth

This exports:

  • Bot credentials → vault_nor_bot_<name>_* variables
  • API keys → vault_nor_api_key_<name> variables

Options

Section titled “Options”
OptionDefaultDescription
--timeout300sTime to wait for browser approval

Troubleshooting

Section titled “Troubleshooting”

Security Best Practices

Section titled “Security Best Practices”

Troubleshooting

Section titled “Troubleshooting”