I have been paying Doppler $39 a month for a secrets manager I stopped using. Tonight I copied everything out of it into logicsrc, which is ours and costs nothing, so the subscription can go.
What was in there
More than I expected. Doppler had 32 projects, one per product, and 128 configs across them once you count the dev, staging and prod branches. Between them, 1,393 keys. Most of the products had moved to logicsrc vaults months ago, but the Doppler copies were never deleted, and nobody wants to be the person who cancels the account with the only copy of a database password in it.
How it went
One script. For every project, list its configs. For every config, download the secrets as a .env, push that file into a logicsrc team vault named for where it came from, and delete the file. Doppler itself was left alone; this is a copy, not a move.
doppler projects --json
doppler configs -p <project> --json
doppler secrets download -p <project> -c <config> --no-file --format env
logicsrc teams push profullstack doppler-<project> <config> --env <file>
The whole run took about 15 minutes and pushed 128 vaults. Every one of them pulls back with the same key count Doppler reports.
Two things bit. Doppler names its branch configs with underscores, dev_personal and the like, and logicsrc vault names only allow lowercase letters, digits and dashes, so the first pass failed on 33 of them until the underscores became dashes. And I edited the script while it was still running. Bash reads a script as it goes, so the patched file threw a syntax error in the last project. Do not do that. Rerun it.
Why logicsrc
The vaults are end to end encrypted, shared per teammate, and there is no plan to pay for. The push is an upsert, so a backup goes into its own namespace rather than on top of the live vaults, and a typo in a vault name silently creates a new vault instead of failing, which is worth knowing before you run 128 of them.
That is $468 a year back for an evening's work, and one fewer place a secret can live.
Top comments (0)