Howto implement application user password change?
How do I implement changes of the db password that an application uses, specifically how do I distribute the new password to all environments that need it?

We've grown to the point where we're needing a second web server, and I'm looking for best practices for keeping configuration files secure and updated.

We've started using virtualenv on our development machines, and we're planning on using it for deployment as well since it gives us an "easy" way to configure the environment `after_install`.

We store the password file outside of the source tree (i.e. not in source control), in a folder that is only accessible to the web/application server user (or in the developers home folder with appropriate permissions set). `after_install` can configure the virtualenv to account for this without much trouble.

Sooner or later we'll probably have to change a password, and I'm hoping y'all can share your experiences.  I'm looking for solutions that don't require human intervention on every server, that don't degrade performance (i.e. having the password file check if it is current every time it is loaded sounds like a lot of wasted cycles for very infrequent updates), that are platform agnostic (we develop on win7 and deploy mostly on debian), that don't have a single point of failure, and that is secure.   .. oh, and it has to be cheap :-)


Howto implement application user password change?
===

How do I implement changes of the db password that an application uses, specifically how do I distribute the new password to all environments that need it?

We've grown to the point where we're needing a second web server, and I'm looking for best practices for keeping configuration files secure and updated.

We've started using virtualenv on our development machines, and we're planning on using it for deployment as well since it gives us an "easy" way to configure the environment `after_install`.

We store the password file outside of the source tree (i.e. not in source control), in a folder that is only accessible to the web/application server user (or in the developers home folder with appropriate permissions set). `after_install` can configure the virtualenv to account for this without much trouble.

Sooner or later we'll probably have to change a password, and I'm hoping y'all can share your experiences.  I'm looking for solutions that don't require human intervention on every server, that don't degrade performance (i.e. having the password file check if it is current every time it is loaded sounds like a lot of wasted cycles for very infrequent updates), that are platform agnostic (we develop on win7 and deploy mostly on debian), that don't have a single point of failure, and that is secure.   .. oh, and it has to be cheap :-)

