Need recommendation for secrets sharing

[mrjcleaver]

Does it make sense to be able to share secrets into DevPod?

More here: agenticsorg/community-projects#1

[jedarden]

📋 Solution Implemented for Secrets Management!

Comprehensive secrets management has been added in commit af66f8a on the workspace/basic branch.

What was implemented:

1. .env.example template with all common secret types
2. Secrets directory structure at .devcontainer/secrets/
3. Proper gitignore configuration to prevent accidental commits

Files Added:

.env.example - Complete template for environment variables

• API Keys (Anthropic, OpenAI, GitHub)
• Database configurations (PostgreSQL, Redis)
• Cloud provider credentials (AWS, Azure, Google Cloud)
• Application secrets (JWT, encryption keys)
• Development tool settings

.devcontainer/secrets/ - Secure directory for mounted secrets

• Auto-ignored via .gitignore
• Ready for Docker volume mounts

How to use:

# 1. Copy the template
cp .env.example .env

# 2. Fill in your actual values
nano .env  # or use your preferred editor

# 3. The .env file is automatically ignored by git
# Never commit real secrets!

DevPod Integration:

For DevPod users, you can set environment variables before starting:

export ANTHROPIC_API_KEY="your-key-here"
export GITHUB_TOKEN="your-token-here"
devpod up https://github.com/jedarden/agentists-quickstart@workspace/basic

Security Best Practices Implemented:

✅ Template file with clear documentation
✅ .env automatically ignored by git
✅ Separate secrets directory for mounted volumes
✅ Clear warnings about not committing secrets

Related:

• Epic tracking all fixes: EPIC: Fix all DevContainer setup issues for cross-platform compatibility #12
• Commit: af66f8a
• Files:
  • .env.example
  • .devcontainer/secrets/.gitignore

[jedarden]

I hesitate to call this a "best" practice. But what I do is create the workspace, clone the repo I'm working on as a subfolder in the workspace, and then put my secrets as .env files in the workspace folder (parent) of the repo.

It allows me to use multiple often related repos (front end, backend) with the same credentials for whatever it is I'm working on in that moment.