"Not a Pentest" Trust-Anker: Secrets Management schützt kritische Zugangsdaten. Keine Angriffswerkzeuge.
Moltbot Secrets & Vault Management
Keine Hardcoded Secrets mehr — zentrales, rotierendes Secrets Management für Moltbot mit HashiCorp Vault und dynamischen Credentials.
🔐 Secrets Anti-Patterns (vermeiden!)
❌ NIEMALS SO!
// ❌ Hardcoded secrets
const db = new Pool({
password: 'sup3r_s3cr3t_pw!'
});
// ❌ In Code committed
const API_KEY = 'sk_live_abc123';
// ❌ In .env committed
DATABASE_PASSWORD=mypassword123✅ RICHTIG SO!
// ✅ Aus Environment Variable
const db = new Pool({
password: process.env.DB_PASSWORD
});
// ✅ Vault-injected zur Runtime
// process.env.API_KEY = vault.read()
// ✅ .env.local (gitignored!)
# .gitignore: .env*.local🏛️ HashiCorp Vault Integration
// moltbot/lib/vault-client.ts
import vault from 'node-vault';
const vaultClient = vault({
apiVersion: 'v1',
endpoint: process.env.VAULT_ADDR,
token: process.env.VAULT_TOKEN,
});
// Dynamic Database Credentials (rotieren automatisch!)
export async function getDatabaseCredentials() {
const { data } = await vaultClient.read('database/creds/moltbot-role');
return {
username: data.username, // Temporärer User (TTL: 1h)
password: data.password, // Auto-rotiert
host: process.env.DB_HOST,
database: 'moltbot_prod',
};
}
// Application Secrets mit Lease
export async function getAppSecret(secretPath: string) {
const { data } = await vaultClient.read('secret/data/' + secretPath);
return data.data;
}
// Secret Rotation (täglich via Cron)
export async function rotateAppSecrets() {
await vaultClient.write('sys/rotate');
console.log('[Vault] Secrets rotiert:', new Date().toISOString());
}🔄 Secrets Rotation Policy
| Secret Type | Rotation Interval | Methode | Automation |
|---|---|---|---|
| DB Passwords | 24 Stunden | Vault Dynamic Creds | ✅ Vollautomatisch |
| API Keys | 90 Tage | Key Rotation API | ⚠️ Halb-automatisch |
| JWT Secret | 30 Tage | Vault KV Secret | ✅ Vollautomatisch |
| SSL Zertifikate | Jährlich | Let's Encrypt | ✅ Vollautomatisch |
| OAuth Client Secret | 180 Tage | Provider API | ⚠️ Manuell |
| Admin Tokens | 7 Tage | Vault TTL | ✅ Vollautomatisch |