Skip to main content

Secrets Manager

Lineserve Secrets Manager provides a secure way to store, manage, and access sensitive information like API keys, passwords, certificates, and other secrets used by your applications and infrastructure.

Overview​

Secrets Manager helps you:

  • Centralize Secret Storage: Store all your secrets in one secure location
  • Control Access: Fine-grained access control with IAM policies
  • Audit Access: Track who accessed which secrets and when
  • Rotate Secrets: Automatic and manual secret rotation capabilities
  • Integrate Easily: Native integration with VPS, Kubernetes, and applications

Key Features​

🔐 Secure Storage​

  • AES-256 encryption at rest
  • TLS encryption in transit
  • Hardware security modules (HSM) backing
  • Zero-knowledge architecture

🎯 Access Control​

  • Role-based access control (RBAC)
  • Time-limited access tokens
  • IP address restrictions
  • Multi-factor authentication support

🔄 Secret Rotation​

  • Automatic rotation for supported services
  • Custom rotation functions
  • Rotation scheduling and notifications
  • Version history and rollback

📊 Monitoring & Auditing​

  • Access logs and audit trails
  • Real-time monitoring and alerts
  • Compliance reporting
  • Integration with monitoring tools

Getting Started​

Creating Your First Secret​

  1. Navigate to Secrets Manager in your Lineserve dashboard

  2. Click "Create Secret"

  3. Choose Secret Type:

    • Database credentials
    • API keys
    • Certificates
    • Custom key-value pairs

  4. Configure the Secret:

    {
      "name": "database-credentials",
      "description": "Production database credentials",
      "type": "database",
      "value": {
        "username": "admin",
        "password": "secure-password-123",
        "host": "db.lineserve.com",
        "port": 5432
      }
    }

  5. Set Access Policies

  6. Enable Rotation (optional)

Accessing Secrets​

Via API​

curl -X GET \
  https://api.lineserve.com/v1/secrets/database-credentials \
  -H "Authorization: Bearer YOUR_API_TOKEN"

Via CLI​

lineserve secrets get database-credentials

In Applications​

// Node.js example
const { LineserveSecrets } = require('@lineserve/secrets');

const secrets = new LineserveSecrets({
  apiKey: process.env.LINESERVE_API_KEY
});

const dbCredentials = await secrets.get('database-credentials');

Secret Types​

Database Credentials​

Store database connection strings, usernames, and passwords with automatic rotation support.

API Keys​

Manage third-party API keys with usage tracking and automatic renewal.

SSL/TLS Certificates​

Store and manage certificates with expiration monitoring and auto-renewal.

Custom Secrets​

Store any key-value pairs for application configuration and sensitive data.

Access Management​

Creating Access Policies​

{
  "name": "production-app-policy",
  "effect": "Allow",
  "actions": [
    "secrets:GetSecret",
    "secrets:ListSecrets"
  ],
  "resources": [
    "arn:lineserve:secrets:*:*:secret/production/*"
  ],
  "conditions": {
    "IpAddress": {
      "lineserve:SourceIp": ["10.0.0.0/8"]
    }
  }
}

Role-Based Access​

  • Admin: Full access to all secrets
  • Developer: Read access to development secrets
  • Application: Limited access to specific secrets
  • Auditor: Read-only access for compliance

Secret Rotation​

Automatic Rotation​

Supported for:

  • Database passwords
  • API keys (where supported by provider)
  • Service account tokens

Manual Rotation​

# Rotate a secret manually
lineserve secrets rotate database-credentials

# Schedule rotation
lineserve secrets schedule-rotation database-credentials --interval 30d

Integration Examples​

With VPS Instances​

# Install secrets agent on VPS
curl -sSL https://get.lineserve.com/secrets-agent | bash

# Configure agent
echo "LINESERVE_API_KEY=your-api-key" > /etc/lineserve/secrets-agent.conf

# Access secrets in applications
export DB_PASSWORD=$(lineserve-secrets get database-credentials --field password)

With Kubernetes​

apiVersion: v1
kind: Secret
metadata:
  name: app-secrets
  annotations:
    lineserve.com/secret-name: "production/app-config"
type: Opaque
data:
  # Automatically populated by Lineserve Secrets Controller

With Docker​

# Use secrets in Docker containers
FROM node:18
COPY . .
RUN npm install

# Secrets injected at runtime
CMD ["node", "app.js"]

Pricing​

FeatureFree TierProEnterprise
Secrets101,000Unlimited
API Calls/month1,000100,000Unlimited
RotationManualAutomaticAdvanced
SupportCommunityEmail24/7 Phone
PriceFree$10/monthCustom

Security & Compliance​

  • SOC 2 Type II certified
  • ISO 27001 compliant
  • GDPR compliant
  • HIPAA eligible
  • PCI DSS Level 1

Best Practices​

Secret Naming​

  • Use descriptive, hierarchical names
  • Include environment prefixes
  • Follow consistent naming conventions

Access Control​

  • Apply principle of least privilege
  • Use temporary credentials when possible
  • Regularly audit access permissions

Rotation Strategy​

  • Enable automatic rotation for critical secrets
  • Test rotation procedures regularly
  • Monitor rotation failures

Troubleshooting​

Common Issues​

Secret Not Found

  • Verify secret name and path
  • Check access permissions
  • Ensure secret exists in correct region

Access Denied

  • Review IAM policies
  • Check API key permissions
  • Verify IP restrictions

Rotation Failures

  • Check service connectivity
  • Verify rotation function code
  • Review error logs

API Reference​

Authentication​

All API requests require authentication via API key or IAM role.

Endpoints​

Get Secret​

GET /v1/secrets/{secret-name}

Create Secret​

POST /v1/secrets

Update Secret​

PUT /v1/secrets/{secret-name}

Delete Secret​

DELETE /v1/secrets/{secret-name}

List Secrets​

GET /v1/secrets

Next Steps​