//TAG
10 posts
DevSecOps · 21 min read
Two Compose services in Dokploy, one for dev and one for production, each with its own Vault AppRole, an HTTPS domain through Traefik, and auto-deploy switched off on purpose so only CI can deploy.
DevSecOps · 20 min read
A red check without a ruleset is just a suggestion. In this part I add no-bypass rulesets to development and main, then prove them with five bad PRs that all get blocked.
DevSecOps · 22 min read
A deploy workflow that builds the image once on development, scans it with Trivy, generates an SBOM, pushes to GHCR, deploys to Dokploy, and promotes that same image to production after an approval.
DevSecOps · 21 min read
How to accept a security finding the official way: one exception per finding, with an owner, a reason and an expiry of at most 90 days, enforced by a required check and a weekly run.
DevSecOps · 23 min read
Removing the Dokploy API key from GitHub: deploy jobs log in to Vault with a GitHub OIDC token and get a 5-minute Vault token that reads one path. Then a look back at the series, the accepted risks, and what could come next.
DevSecOps · 20 min read
A public repo with the right security settings, then a pr-checks workflow with seven checks: tests, Gitleaks, Semgrep, govulncheck, dependency review, Trivy config, and Trivy image. Plus a source-branch gate for PRs into main.
DevSecOps · 21 min read
A vault-agent container logs in to Vault with AppRole, renders config.json to a tmpfs volume with mode 0400, and the app reads it read-only. Plus how to test the whole thing on a laptop against a Vault dev server.
DevSecOps · 18 min read
Building secure-cicd-go: a small Go API with HS256 JWTs and AES-256-GCM that reads its secrets from a file, exits on invalid config, reports its commit on /version, and ships as a distroless non-root image.
DevSecOps · 13 min read
Setting up secrets in Vault KV v2, a read-only policy per environment, and separate AppRoles for dev and production, then proving the dev credential is refused in production.
DevSecOps · 8 min read
The big picture of secure-cicd-go: the problem it solves, the path from PR to production, the list of security gates, and the tools to install before we start.