I've written an application in NodeJS which essentially only performs a login: You send your username/password, and you retrieve an JWT (JSON Web Token).
Those tokens are being signed by a private key. Using HMAC, these tokens can be verified using the public key so that noone can change the data inside.
Other API-Endpoints on different servers will get the public-key and can check that the user is actually verified/logged in and is able to access that route.
Now, my issue being, that I put that service inside a Docker-Container. Inside the container, the application just starts up and opens its port so the HTTPS requests can be received.
Assuming I want to start the container multiple times for loadbalancing aswell as a measure against failures, how would I pass the single private key into all started instances, so they could sign the tokens that I want to hand out?
I dont think that just having a fileshare e.g. SMB/NFS where the private key is located on is a good idea. On the other hand, a custom E2E System seems to be overkill for my purpose.
How would you go ahead and share the single private key to multiple instances, without having a breach at risk?