There are these relevant questions questions:
- Strategy for keeping secret info such as API keys out of source control?
- How do you deal with configuration files in source control?
- How to version control config files pragmatically?
But as far as I can tell, they deal with the opposite side of the problem. So yes, we've designed a good application that has no secrets stored in it or its repository. They either pull them from the environment variables or from files stored on the system. Great, awesome, secure, right?
But what about our secrets? Where do they come from? Do we store these in another vcs repository? Do they only exist in an encrypted database?
Obviously we want developers to have their own credential sets - but we're going to need to have credentials for our test/preprod/prod servers.
How do we keep those secure? Of course we want them accessible to the systems that need them...