Tools

Tools: Production Docker Secrets for Self-Hosted Crypto Infrastructure - Complete Guide

2026-05-28 0 views admin
Tools: Production Docker Secrets for Self-Hosted Crypto Infrastructure - Complete Guide

Why Docker Secrets Matter for Crypto Infrastructure

WAIaaS Docker Secrets Implementation

Setting Up Production Secrets

Security Benefits Over Environment Variables

Secrets Rotation and Management

Alternative: Auto-Provision for Development

Quick Start: Production Deployment

What's Next Production Docker secrets are the difference between a weekend prototype and infrastructure you'd trust with real assets. When self-hosting crypto wallet infrastructure, your security model determines whether you sleep soundly or wake up to empty wallets. Traditional environment variables leak secrets through process lists, Docker inspect commands, and container logs. In crypto infrastructure, this means private keys, master passwords, and RPC endpoints become visible to anyone with container access. The stakes are higher than typical web applications. A compromised database password might leak user data, but a compromised wallet master password gives attackers direct access to cryptocurrency holdings across multiple wallets and chains. WAIaaS provides a production-ready secrets overlay using Docker Compose's native secrets management. Instead of passing sensitive values through environment variables, secrets are mounted as files inside containers with restricted permissions. Here's the basic deployment without secrets: The production secrets overlay (docker-compose.secrets.yml) adds Docker secrets integration: Create the secrets directory structure: Deploy with the secrets overlay: Inside the container, WAIaaS reads secrets from /run/secrets/ instead of environment variables. The entrypoint script automatically detects *_FILE environment variables and loads the corresponding file contents. Docker secrets provide several security advantages for crypto infrastructure: Process isolation: Secrets appear as tmpfs files mounted only inside target containers, invisible to docker inspect and process lists. File permissions: Secret files have 600 permissions (owner read-only) by default, preventing unauthorized access even within the container. No leak through logs: Environment variables containing secrets can accidentally appear in application logs or error messages. File-based secrets reduce this risk. Swarm compatibility: Docker secrets work seamlessly with Docker Swarm for multi-node deployments, with automatic secret distribution and rotation capabilities. The WAIaaS daemon runs as UID 1001 (non-root) inside containers, following security best practices. Combined with secret files, this creates defense-in-depth against container escape vulnerabilities. Production crypto infrastructure requires periodic secret rotation. WAIaaS supports hot-reloading of RPC endpoint secrets without restarting wallets or interrupting AI agent operations. Master password rotation requires more care since it encrypts wallet private keys: For development and testing, WAIaaS supports auto-provisioning that generates random master passwords automatically: Auto-provision creates a recovery.key file containing the randomly generated master password. This provides convenience for development while maintaining security through cryptographically strong password generation. For production use, replace auto-provision with explicit secrets after initial setup: Here's the minimal setup for production-ready WAIaaS with Docker secrets: The daemon starts with encrypted storage, production RPC endpoints, and no secrets visible through Docker inspect or process lists. For ongoing management, consider setting up automated secret rotation, monitoring for RPC endpoint health, and implementing backup procedures for the waiaas-data Docker volume containing encrypted wallet files. Self-hosted crypto infrastructure requires careful attention to operational security. Docker secrets provide a foundation, but remember that physical security of the host machine, network isolation, and proper backup procedures are equally important for protecting cryptocurrency holdings. Ready to deploy your own self-hosted wallet infrastructure? Get started with the complete setup guide at GitHub or explore the architecture documentation at waiaas.ai. Master the policy engine to control exactly what your AI agents can do with your funds, or explore MCP integration to connect your wallets with Claude Desktop for conversational crypto management. Templates let you quickly answer FAQs or store snippets for re-use. Hide child comments as well For further actions, you may consider blocking this person and/or reporting abuse

Code Block

Copy

services: daemon: image: ghcr.io/minhoyoo-iotrust/waiaas:latest container_name: waiaas-daemon ports: - "127.0.0.1:3100:3100" volumes: - waiaas-data:/data environment: - WAIAAS_DATA_DIR=/data - WAIAAS_DAEMON_HOSTNAME=0.0.0.0 restart: unless-stopped healthcheck: test: ["CMD", "curl", "-f", "http://localhost:3100/health"] interval: 30s timeout: 5s start_period: 10s retries: 3 services: daemon: image: ghcr.io/minhoyoo-iotrust/waiaas:latest container_name: waiaas-daemon ports: - "127.0.0.1:3100:3100" volumes: - waiaas-data:/data environment: - WAIAAS_DATA_DIR=/data - WAIAAS_DAEMON_HOSTNAME=0.0.0.0 restart: unless-stopped healthcheck: test: ["CMD", "curl", "-f", "http://localhost:3100/health"] interval: 30s timeout: 5s start_period: 10s retries: 3 services: daemon: image: ghcr.io/minhoyoo-iotrust/waiaas:latest container_name: waiaas-daemon ports: - "127.0.0.1:3100:3100" volumes: - waiaas-data:/data environment: - WAIAAS_DATA_DIR=/data - WAIAAS_DAEMON_HOSTNAME=0.0.0.0 restart: unless-stopped healthcheck: test: ["CMD", "curl", "-f", "http://localhost:3100/health"] interval: 30s timeout: 5s start_period: 10s retries: 3 services: daemon: secrets: - master_password - solana_rpc_mainnet - ethereum_rpc_mainnet environment: - WAIAAS_MASTER_PASSWORD_FILE=/run/secrets/master_password - WAIAAS_RPC_SOLANA_MAINNET_FILE=/run/secrets/solana_rpc_mainnet - WAIAAS_RPC_EVM_ETHEREUM_MAINNET_FILE=/run/secrets/ethereum_rpc_mainnet secrets: master_password: file: ./secrets/master_password.txt solana_rpc_mainnet: file: ./secrets/solana_rpc_mainnet.txt ethereum_rpc_mainnet: file: ./secrets/ethereum_rpc_mainnet.txt services: daemon: secrets: - master_password - solana_rpc_mainnet - ethereum_rpc_mainnet environment: - WAIAAS_MASTER_PASSWORD_FILE=/run/secrets/master_password - WAIAAS_RPC_SOLANA_MAINNET_FILE=/run/secrets/solana_rpc_mainnet - WAIAAS_RPC_EVM_ETHEREUM_MAINNET_FILE=/run/secrets/ethereum_rpc_mainnet secrets: master_password: file: ./secrets/master_password.txt solana_rpc_mainnet: file: ./secrets/solana_rpc_mainnet.txt ethereum_rpc_mainnet: file: ./secrets/ethereum_rpc_mainnet.txt services: daemon: secrets: - master_password - solana_rpc_mainnet - ethereum_rpc_mainnet environment: - WAIAAS_MASTER_PASSWORD_FILE=/run/secrets/master_password - WAIAAS_RPC_SOLANA_MAINNET_FILE=/run/secrets/solana_rpc_mainnet - WAIAAS_RPC_EVM_ETHEREUM_MAINNET_FILE=/run/secrets/ethereum_rpc_mainnet secrets: master_password: file: ./secrets/master_password.txt solana_rpc_mainnet: file: ./secrets/solana_rpc_mainnet.txt ethereum_rpc_mainnet: file: ./secrets/ethereum_rpc_mainnet.txt mkdir -p secrets chmod 700 secrets # Create master password (generates wallet encryption key) openssl rand -base64 32 > secrets/master_password.txt # Add RPC endpoints for mainnet access echo "https://api.mainnet-beta.solana.com" > secrets/solana_rpc_mainnet.txt echo "https://eth-mainnet.alchemyapi.io/v2/your-key" > secrets/ethereum_rpc_mainnet.txt # Restrict file permissions chmod 600 secrets/*.txt mkdir -p secrets chmod 700 secrets # Create master password (generates wallet encryption key) openssl rand -base64 32 > secrets/master_password.txt # Add RPC endpoints for mainnet access echo "https://api.mainnet-beta.solana.com" > secrets/solana_rpc_mainnet.txt echo "https://eth-mainnet.alchemyapi.io/v2/your-key" > secrets/ethereum_rpc_mainnet.txt # Restrict file permissions chmod 600 secrets/*.txt mkdir -p secrets chmod 700 secrets # Create master password (generates wallet encryption key) openssl rand -base64 32 > secrets/master_password.txt # Add RPC endpoints for mainnet access echo "https://api.mainnet-beta.solana.com" > secrets/solana_rpc_mainnet.txt echo "https://eth-mainnet.alchemyapi.io/v2/your-key" > secrets/ethereum_rpc_mainnet.txt # Restrict file permissions chmod 600 secrets/*.txt docker compose -f docker-compose.yml -f docker-compose.secrets.yml up -d docker compose -f docker-compose.yml -f docker-compose.secrets.yml up -d docker compose -f docker-compose.yml -f docker-compose.secrets.yml up -d # Update RPC endpoint echo "https://new-rpc-endpoint.com" > secrets/solana_rpc_mainnet.txt # Reload configuration (sends SIGHUP to daemon) docker compose kill -s SIGHUP daemon # Update RPC endpoint echo "https://new-rpc-endpoint.com" > secrets/solana_rpc_mainnet.txt # Reload configuration (sends SIGHUP to daemon) docker compose kill -s SIGHUP daemon # Update RPC endpoint echo "https://new-rpc-endpoint.com" > secrets/solana_rpc_mainnet.txt # Reload configuration (sends SIGHUP to daemon) docker compose kill -s SIGHUP daemon # 1. Create new master password openssl rand -base64 32 > secrets/master_password_new.txt # 2. Migrate wallets to new password (requires downtime) docker compose down docker compose -f docker-compose.yml -f docker-compose.secrets.yml run --rm daemon migrate-master-password # 3. Replace old password file mv secrets/master_password_new.txt secrets/master_password.txt docker compose -f docker-compose.yml -f docker-compose.secrets.yml up -d # 1. Create new master password openssl rand -base64 32 > secrets/master_password_new.txt # 2. Migrate wallets to new password (requires downtime) docker compose down docker compose -f docker-compose.yml -f docker-compose.secrets.yml run --rm daemon migrate-master-password # 3. Replace old password file mv secrets/master_password_new.txt secrets/master_password.txt docker compose -f docker-compose.yml -f docker-compose.secrets.yml up -d # 1. Create new master password openssl rand -base64 32 > secrets/master_password_new.txt # 2. Migrate wallets to new password (requires downtime) docker compose down docker compose -f docker-compose.yml -f docker-compose.secrets.yml run --rm daemon migrate-master-password # 3. Replace old password file mv secrets/master_password_new.txt secrets/master_password.txt docker compose -f docker-compose.yml -f docker-compose.secrets.yml up -d docker run -d \ --name waiaas \ -p 127.0.0.1:3100:3100 \ -v waiaas-data:/data \ -e WAIAAS_AUTO_PROVISION=true \ ghcr.io/minhoyoo-iotrust/waiaas:latest # Retrieve auto-generated password docker exec waiaas cat /data/recovery.key docker run -d \ --name waiaas \ -p 127.0.0.1:3100:3100 \ -v waiaas-data:/data \ -e WAIAAS_AUTO_PROVISION=true \ ghcr.io/minhoyoo-iotrust/waiaas:latest # Retrieve auto-generated password docker exec waiaas cat /data/recovery.key docker run -d \ --name waiaas \ -p 127.0.0.1:3100:3100 \ -v waiaas-data:/data \ -e WAIAAS_AUTO_PROVISION=true \ ghcr.io/minhoyoo-iotrust/waiaas:latest # Retrieve auto-generated password docker exec waiaas cat /data/recovery.key # Extract auto-generated password MASTER_PASSWORD=$(docker exec waiaas cat /data/recovery.key) # Create proper secret file echo "$MASTER_PASSWORD" > secrets/master_password.txt chmod 600 secrets/master_password.txt # Redeploy with secrets overlay docker compose down docker compose -f docker-compose.yml -f docker-compose.secrets.yml up -d # Remove recovery.key file docker exec waiaas rm /data/recovery.key # Extract auto-generated password MASTER_PASSWORD=$(docker exec waiaas cat /data/recovery.key) # Create proper secret file echo "$MASTER_PASSWORD" > secrets/master_password.txt chmod 600 secrets/master_password.txt # Redeploy with secrets overlay docker compose down docker compose -f docker-compose.yml -f docker-compose.secrets.yml up -d # Remove recovery.key file docker exec waiaas rm /data/recovery.key # Extract auto-generated password MASTER_PASSWORD=$(docker exec waiaas cat /data/recovery.key) # Create proper secret file echo "$MASTER_PASSWORD" > secrets/master_password.txt chmod 600 secrets/master_password.txt # Redeploy with secrets overlay docker compose down docker compose -f docker-compose.yml -f docker-compose.secrets.yml up -d # Remove recovery.key file docker exec waiaas rm /data/recovery.key git clone https://github.com/minhoyoo-iotrust/WAIaaS.git cd WAIaaS mkdir -p secrets && chmod 700 secrets git clone https://github.com/minhoyoo-iotrust/WAIaaS.git cd WAIaaS mkdir -p secrets && chmod 700 secrets git clone https://github.com/minhoyoo-iotrust/WAIaaS.git cd WAIaaS mkdir -p secrets && chmod 700 secrets openssl rand -base64 32 > secrets/master_password.txt chmod 600 secrets/master_password.txt openssl rand -base64 32 > secrets/master_password.txt chmod 600 secrets/master_password.txt openssl rand -base64 32 > secrets/master_password.txt chmod 600 secrets/master_password.txt echo "https://your-solana-rpc.com" > secrets/solana_rpc_mainnet.txt echo "https://your-ethereum-rpc.com" > secrets/ethereum_rpc_mainnet.txt chmod 600 secrets/*.txt echo "https://your-solana-rpc.com" > secrets/solana_rpc_mainnet.txt echo "https://your-ethereum-rpc.com" > secrets/ethereum_rpc_mainnet.txt chmod 600 secrets/*.txt echo "https://your-solana-rpc.com" > secrets/solana_rpc_mainnet.txt echo "https://your-ethereum-rpc.com" > secrets/ethereum_rpc_mainnet.txt chmod 600 secrets/*.txt docker compose -f docker-compose.yml -f docker-compose.secrets.yml up -d docker compose -f docker-compose.yml -f docker-compose.secrets.yml up -d docker compose -f docker-compose.yml -f docker-compose.secrets.yml up -d curl http://127.0.0.1:3100/health # Should return {"status": "healthy"} curl http://127.0.0.1:3100/health # Should return {"status": "healthy"} curl http://127.0.0.1:3100/health # Should return {"status": "healthy"} - Clone and setup secrets: - Generate master password: - Add RPC endpoints: - Deploy with secrets: - Verify deployment:

🏷️ Tags

toolsutilitiessecurity toolsproductiondockersecretshostedcryptoinfrastructurecomplete

More from Tools

Tools: 2 of 128 YC-backed dev tools companies block unchecked merges Only

Tools: 2 of 128 YC-backed dev tools companies block unchecked merges Only

2026-05-28 0
Tools: Linux User & Group Management Explained Simply (2026)

Tools: Linux User & Group Management Explained Simply (2026)

2026-05-28 0
Tools: The const enum that took down our payments - Full Analysis

Tools: The const enum that took down our payments - Full Analysis

2026-05-28 0
Tools: Transform Raspberry Pi into an AI-Native IDS with NAPSE - Complete Guide

Tools: Transform Raspberry Pi into an AI-Native IDS with NAPSE - Complete Guide

2026-05-28 0

Trending

1

CVE-2025-61481: Critical Remote Code Execution Vulnerability in MikroTik RouterOS & SwitchOS

2025-10-27 • 189 views
2

CVE-2025-43939: Dell Unity OS Command Injection (High)

2025-10-30 • 148 views
3

Google disputes false claims of massive Gmail data breach

2025-10-30 • 130 views
4

Microsoft: DNS outage impacts Azure and Microsoft 365 services

2025-10-30 • 88 views
5

3.5B Accounts, 1 Critical Flaw: Meta Closes WhatsApp Data-Harvesting

2025-11-25 • 81 views