The Trigger.dev breach was all about environment variables. On my own boxes, I keep bot API keys out of plain env vars and unit files with systemd credentials. It’s built in, so there’s nothing to install.
1. Encrypt the key
sudo mkdir -p /etc/credstore.encrypted
read -rs KEY; printf '%s' "$KEY" | sudo systemd-creds encrypt --name=ai_key - /etc/credstore.encrypted/ai_key; unset KEYIt gets encrypted with the machine’s key (and the TPM if you have one), so the file is useless on another box.
2. Load it in the service
[Service]
LoadCredentialEncrypted=ai_key
ExecStart=/opt/mybot/runsystemd decrypts it at start into a private, read-only folder only that service can see.
3. Read it from the file
Have your bot read the key from $CREDENTIALS_DIRECTORY/ai_key instead of an env var. If the tool only takes an env var, export it in a small wrapper script right before exec, so it never sits in the unit file.
4. Check it
systemctl show mybot -p Environment
systemd-analyze security mybotThe first command shouldn’t show any secrets.
It won’t stop a full root compromise. But keys don’t leak through systemctl show, crash dumps, or a copied unit file. Pair it with rootless services and spend caps.
God Bless, and May the Source Be with You!
