We have big legacy code working for big corporation connecting to multiple remote/local databases.
The configuration files with IP, name and password for connecting to different databases are now handled manually. We have these files in git, but our passwords rotate on different schedule than our deployment, so we need to directly edit the configs on our servers(production, UAT, testing, development).
This is really tedious task and errors appear regularly. Different servers are connected to different databases and connecting multiple times with bad password will lock the id.
We are thinking about creating a service to distribute the config files into the servers. The idea is, that every midnight, some bash script on the server will access this service, and rewrite config files with data provided by this service.
Than, we only need to store name of server(to tell the service, which config we need) and SSH key to connect to service.
The question is, is this good solution? I see the problem that when one ssh key gets compromised, than all our passwords are available. Is there some other more standard way to solve our problem?