Secrets Don't Belong in Config

I'm Matt Wood, and this is For Your Information. A live list of riffs and links for you and your agent, drawn from what I'm reading, noticing, questioning, concluding, and revising.

Configuration and secrets have different lifecycles and security requirements—keeping them separate prevents coupling issues. The article analyzes how NixOS modules handle secrets and advocates for dedicated secret interfaces rather than merging them into configuration files.

secretspec.dev →

Connections

Supports

Analyzing Metastable Failures Metastable failures often stem from configuration coupling issues; keeping secrets separate from config reduces a class of failure modes where secret rotation causes cascading config reloads
Lessons I've Learned at Warp Building for Developers Lessons building developer tooling at Warp align with the article's thesis: developer experience improves when secrets management is a first-class concern separated from general configuration rather than bolted on
Cedar Policy Cedar Policy enforces access control through declarative policy separate from application config, exemplifying the principle that security concerns (secrets, permissions) should be decoupled from general configuration

Related to

OpenSSH 10.5 Release Notes OpenSSH 10.5 deals with cryptographic key management and authentication secrets in system configuration—directly relevant to the separation of secrets from config in infrastructure tooling
Exploring AWS DevOps Agent Part 3 - Troubleshooting Issues AWS DevOps agent troubleshooting frequently involves secrets/credentials misconfigured alongside application settings—the lifecycle separation principle the article advocates would prevent common DevOps agent configuration errors
Omarchy: Modern Linux Distribution Omarchy as a modern Linux distribution faces the same NixOS-adjacent problem of secrets management in declarative system configuration—the article's NixOS module analysis directly applies

Type:	link
First published:	Monday, 17 August 2026 at 19:13 UTC
Location:	https://secretspec.dev/blog/secrets-dont-belong-in-config/
URL:	https://mattwood.fyi/i/bea989e7