|
| 1 | +# Secrets |
| 2 | + |
| 3 | +<blockquote class="info"> |
| 4 | +This article explains how to use secrets in a workspace. To authenticate the |
| 5 | +workspace provisioner, see <a href="./templates/authentication">this</a>. |
| 6 | +</blockquote> |
| 7 | + |
| 8 | +Coder takes an unopinionated stance to workspace secrets. |
| 9 | + |
| 10 | +## Wait a minute... |
| 11 | + |
| 12 | +Your first stab at secrets with Coder should be your local method. |
| 13 | +You can do everything you can locally and more with your Coder workspace, so |
| 14 | +whatever workflow and tools you already use to manage secrets can be brought |
| 15 | +over. |
| 16 | + |
| 17 | +For most, this workflow is simply: |
| 18 | + |
| 19 | +1. Give your users their secrets in advance |
| 20 | +1. They write them to a persistent file after |
| 21 | + they've built a workspace |
| 22 | + |
| 23 | +<a href="./templates#parameters">Template parameters</a> are a dangerous way to accept secrets. |
| 24 | +We show parameters in cleartext around the product. Assume anyone with view |
| 25 | +access to your workspace can also see parameters. |
| 26 | + |
| 27 | +## Dynamic Secrets |
| 28 | + |
| 29 | +Dynamic secrets are attached to the workspace lifecycle and require no setup by |
| 30 | +the end user. |
| 31 | + |
| 32 | +They can be implemented in native Terraform like so: |
| 33 | + |
| 34 | +```hcl |
| 35 | +resource "twilio_iam_api_key" "api_key" { |
| 36 | + account_sid = "ACXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" |
| 37 | + friendly_name = "Test API Key" |
| 38 | +} |
| 39 | +
|
| 40 | +resource "coder_agent" "dev" { |
| 41 | + # ... |
| 42 | + env = { |
| 43 | + # Let users access the secret via #TWILIO_API_SECRET |
| 44 | + TWILIO_API_SECRET = "${twilio_iam_api_key.api_key.secret}" |
| 45 | + } |
| 46 | +} |
| 47 | +``` |
| 48 | + |
| 49 | +This method is limited to [services with Terraform providers](https://registry.terraform.io/browse/providers). |
| 50 | + |
| 51 | +A catch-all variation of this approach is dynamically provisioning a cloud service account (e.g [GCP](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_service_account_key#private_key)) |
| 52 | +for each workspace and then make the relevant secrets available via the cloud's secret management |
| 53 | +system. |
| 54 | + |
| 55 | +## Coder SSH Key |
| 56 | + |
| 57 | +Coder automatically inserts an account-wide SSH key into each workspace. In MacOS |
| 58 | +and Linux this key is at `~/.ssh/id_ecdsa`. You can view and |
| 59 | +regenerate the key in the dashboard at Settings > SSH keys. |
0 commit comments