systemd-creds Offers a Safer Alternative to Storing Secrets in Environment Variables

·1 views

Linux systems commonly expose sensitive credentials through environment variables or world-readable unit files, creating security risks for both homelab and production setups. systemd provides a built-in alternative called credentials, which are encrypted blobs loaded at service activation and stored in a private, permission-restricted directory exposed via the $CREDENTIALS_DIRECTORY variable. The operator tool systemd-creds, available since systemd 250, supports optional AES-256-GCM encryption at rest using TPM2 or a host secret. Credentials are scoped strictly to the target service, released upon deactivation, and remain immutable during runtime, unlike environment variables which are inherited by child processes. This approach works with containerized and portable services and supports multiple credential sources including encrypted files, inline values, and socket-based delivery.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

XML Namespace Prefix Change by Customs Broker Halted 270 Shipments for Hours

A weekend platform upgrade by a customs broker changed the XML namespace prefix in their export declaration messages from 'cus' to 'ns2', which are technically equivalent but broke a six-year-old reader that matched elements by literal prefix string. On a Monday in October, 270 shipments sat uncleared at the warehouse while the system silently treated unreadable statuses as 'pending', logging no errors and acknowledging all messages normally. The issue went undetected until a warehouse lead called the broker repeatedly and obtained a raw message file, after which engineers patched the reader and replayed archived messages within the same afternoon. The fix replaced prefix-dependent XPath and regex logic with a namespace-aware parser that matches elements by URI and local name, and unreadable statuses now trigger alerts via a rejected queue instead of defaulting to pending. The team also updated contract tests to include messages with varied prefixes and requested advance notice from partners before any future platform changes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Warehouse Fixes £400k Stock Error Problem by Treating Short Picks as Live Audits

A UK warehouse operation was losing nearly £400,000 annually in credits and lost orders due to persistent stock discrepancies between its inventory system and physical shelf contents. The system maintained a running balance calculated from scans rather than actual counts, meaning unscanned movements — such as damaged stock disposal or misplaced pallets — were never corrected until the annual stocktake. At the largest depot, one in seven locations held a quantity that differed from the system's recorded figure, with some empty locations generating daily short picks for over a month while replenishment never refilled them. The team redesigned their process so that a short pick now triggers an immediate location hold and a physical count within the hour, with continuous cycle counting prioritising high-risk and fast-moving locations. As a result, short picks have roughly halved and the annual stocktake has been reduced from three days to one.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Three Converging Technologies Made AI Voice Agents Sound Human

AI phone agents have become significantly more human-sounding over the past two years, not due to a single breakthrough but because three core components — speech-to-text, language models, and text-to-speech — all matured simultaneously. Each stage must operate in a streaming fashion, overlapping rather than running sequentially, to keep response latency within the 800-millisecond window that human conversation demands. Turn-taking is managed through techniques like semantic endpointing, which judges whether a speaker has finished based on meaning rather than silence alone, and barge-in support that lets callers interrupt the agent naturally. Model selection also involves trade-offs, with many production systems using a smaller, faster model for routine exchanges and routing complex requests to a larger one. Despite major improvements in prosody and naturalness, current systems still struggle with proper nouns, regional place names, and non-English pronunciation, making locale-specific testing essential.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

RAG Architecture Explained: Five Boxes, Six Arrows, and Hidden Costs

A Retrieval-Augmented Generation (RAG) system can be broken down into five core components: an index, a retriever, a reranker, a context builder, and a loop controller. Each connection between these components carries a data payload that incurs costs both when data is moved and when it is processed. The index sets a hard ceiling on system performance, since any fact lost during chunking or indexing cannot be recovered downstream by reranking or prompt engineering. The context builder is the only component that can actively reduce costs within a single request, while the loop controller poses the greatest billing risk because each additional iteration re-runs all upstream components. Engineers are advised to map every data transfer across their stack and price the largest one — the input into the model prompt — to estimate baseline monthly retrieval costs before any optimization.

0 comments Read more at DEV Community