But how? I couldn't publish it to the npm registry as the base project it used contained proprietary code. Now, I had to make this CLI available to engineers at the company. Creating the base project was easy enough, but why stop there? I decided to take it a step further and create a custom CLI for generating base projects. In my free time, I set out to create a base project repo that we could clone for our new SPAs. Our process for starting a new one was to copy an existing SPA and then strip out the app-specific code to get back to a base setup, then start building. Then, we were on our third and we planned to create more. What Changed?Īt work, we were transitioning to React single-page applications. Actually, I work almost exclusively on the front-end.ĭuring my transition to full-stack I was introduced to the npm package manager, but only what I needed to know at the time - npm install, npm uninstall, npm update - heck, even installing specific versions! Year in and year out, that was all I really needed. I started out as a backend Java engineer before transitioning to full-stack as my role with my company at the time grew. I'm trying to avoid checking in any sensitive data while making it easy for other people to run this locally.Did you know you can npm install from a Git Repository? My question is what is the most secure possible solution that is automated (minimal manual steps for users of the file)? Time of implementation is less of a concern.

Use Docker secrets and docker stack deploy and store the key in docker secrets (CON: docker stack deploy has no support for docker volumes yet. (CONS: probably lots of work, maybe other issues?) (CONS: see 2)ĭockerise something like run that up first, add the key and use that within the node containers to get the latest key. I've looked around for a solution and none seem very easy/non hackyĬopy the key in and squash (CONS: not sure how I do this in a docker-compose file) Ĭopy the key in on the build step and add to image. I understand this doesn't work because I don't have the deploy key I use on my local system in the Docker context.

However when I try to use this with my docker-compose setup it fails on the npm install step, in the build stage. My use case is that I have multiple express micro-services that use the same middleware and I would like to create a different repo in the format of an npm module for each middleware.Įvery repo is a private repo and can have a deploy key attached (can be different keys or the same)Īll of this works OK locally.

Npm install github repository