[GSOC2020] Secrets Manager


I was trying to figure out a plan of action on how to approach this project. Consequently, I was looking at how Django internally manages things. I had a doubt about the ‘Convention over Configuration’ aspect.

Following the aforementioned principle, Django, is able to locate corresponding views, static files, given that recommenced naming convention is followed. In the scope of this project, Secrets Manager, ideally, a similar flow should be in place when per-environment are .env files that are read by, let’s say, django-environ. 2 approaches could be considered here:

  1. Have the end-user enter the path of the .env files and have the end-user register the .env with a label that she/he can later give as an input to manage.py to specify which .env to use
  2. Read all .env files in the scope of the project and define a naming convention such that the app for secrets management parses the name of the file to define the label for that .env, again, this label will have to be used by the end-user

I feel approach 2 is more Django-like. In case, you would recommend this approach (2), I would like some help in understanding how Django manages to prune through the file structure and achieve ‘Convention over Configuration’.

Also, please let me know if neither of the approaches can be deemed appropriate.

Thanking you in anticipation,
Abhirav Dilip Kariya
NCSU (Master’s in Machine Learning)

OK, so there’s an interesting question as to how we might bootstrap a secrets manager.

The Django Way™ is to put such things in settings, but the whole(?) point of this is to keep values that would go into setting out of it.

Maybe instantiating the secrets manager would have to go early in the settings file — with some aspects passed from the command line: the settings file can’t include credentials for the secrets store! I’d make it explicit what strategy was being followed etc.

Part of the project is to work this out.


1 Like

That’s great. Pretty excited that I have considered all of this.
I’ll share my proposal in a couple of days for review.
Thanks a lot.

Hi @carltongibson,

I’ve submitted my proposal draft for GSoC. Here is the link to my proposal: GSoC Proposal
Link to Prototype Gist
Link to Prototype

Please let me know if you get the time to go through it and have any feedback for me.

Thanks in advance,
Abhirav Dilip Kariya