Perfectly Sane Secret Synchronization Technology is a small service for delivering secrets to machines when they start.
A client announces its hostname over UDP. The server looks up that host in its configuration, obtains the configured secrets by running local commands, and copies them to the machine over SSH. The client exits once delivery succeeds.
The included NixOS module can run both sides as systemd services and order other services after secret delivery.
A new cluster node needs an RKE2 token before it can join the cluster. pssst
can fetch the token from a password manager on a trusted server, place it on the
node with restricted permissions, and then allow RKE2 to start. The node only
needs SSH access from the server; it does not need credentials for the password
manager.