How to securely encrypt secrets over Github Webhooks?

Question

I have a service running on a server that updates and restarts itself whenever I push new code to the repository using Github Webhooks. It has access to a bunch of databases, and the credentials for those databases are hard coded into a config file. I want to encrypt the config file and only decrypt it into memory when the service starts.

Since I have the service being started, it's looking like the encryption key will need to exist on the web server, which defeats the point of encrypting the file in the first place.

Can I use some authentication property of Github as the encryption key or in some other way pass a key to the server that isn't saved to disk? How should this file be secured?

Answer 1

How should this file be secured?

Not by GitHub or anything Git related.

You need either:

• an external service (like hashicorp/vault )
• or a plateform able to distribute a secret securely (like a docker secret )

But GitHub itself only hosts repo, it does not manage secrets.
A GitHub webhook is just a callback, meaning there mush be a service listening to that callback.