title: .NetCore 2.0 secure store credentials in production "on premise" servers
body: <p>I've just had a wow when I've read that storing Api keys, connection strings in configs and push them to git(even in a private repository) is not good. I will need a secure website. I've google it and found some solutions for this but none of them is good enough.</p>
  
  <p>1 use env vars. <strong>Issue</strong> exposed in plain text for user</p>
  
  <p>2 keep then in a config file not pushed to git(put the folder/file in .gitignore. <strong>Issue</strong> exposed in plain text </p>
  
  <p>3 The config should be encrypted and decrypt on start-up the config file. <strong>Issue</strong> the encryption/decryption key needs to be kept on server in plain text.
  4. Like 3 but the encryption key is stored half in git half on hard. 
  <strong>Issue</strong> this combine the git and plain text on server</p>
  
  <p>Until now those are the versions I've reached over but they all seem to have a problem.
  What is the <strong>best option</strong> you think of for keeping the api keys/ connections string /secret encryption string while using .netCore 2.0.</p>
  
  <p>The deploy server is a centOs 7 "in house" server with a .netCore 2.0 and apache server as reverse proxy.</p>