Describe your feature request
Provide a mechanism to configure the database userpassword from a docker secret
Currently, the prescribed mechanism to convey the database user credentials to containerized chevereto is via a docker envvar.
While this works well enough, as MySQL supports the pattern of:
MySQL ALSO supports the pattern of:
now, clearly, not much can be said about the kwality of these passwords except perhaps for their comedic value, but there is a legitimate security improvement in not exposing the cred via envvars.
Not only does this allow one to avoid potentially littering a running environment with creds in shell memory, it also allows the credential plumbing mechanics to be declared in the composefile without the credentials.
essentially, I'm requesting the ability to use EITHER the envvar
(you could, for example, check to see if the default filepath
it's not quite clear to me how the credential ultimately gets populated into
Where did you see this?
Docker compose docs on secrets
Community interest
Provide a mechanism to configure the database userpassword from a docker secret
Currently, the prescribed mechanism to convey the database user credentials to containerized chevereto is via a docker envvar.
While this works well enough, as MySQL supports the pattern of:
Code:
export MYSQL_ROOT_PASSWORD=hunter2
export MYSQL_PASSWORD=I.HEART.PANDASMySQL ALSO supports the pattern of:
Code:
echo 'hunter2' > /etc/s3kr3t/mysql_root_password_totally_secure_n_stuff_k
echo 'I.HEART.PANDAS' > /etc/s3kr3t/mysql_user_password_dont_look_here_plz
export "MYSQL_ROOT_PASSWORD_FILE=/etc/s3kr3t/mysql_root_password_totally_secure_n_stuff_k"
export "MYSQL_PASSWORD_FILE=/etc/s3kr3t/mysql_user_password_dont_look_here_plz"now, clearly, not much can be said about the kwality of these passwords except perhaps for their comedic value, but there is a legitimate security improvement in not exposing the cred via envvars.
Not only does this allow one to avoid potentially littering a running environment with creds in shell memory, it also allows the credential plumbing mechanics to be declared in the composefile without the credentials.
essentially, I'm requesting the ability to use EITHER the envvar
CHEVERETO_DB_PASS OR, if set, prefer to consume the db pass from CHEVERETO_DB_PASS_FILE ... or some other mechanism which is compatible with docker secrets.(you could, for example, check to see if the default filepath
/run/secrets/whatever_secret_file_name_is_the_most_intuitive exists, and contains a db credit's not quite clear to me how the credential ultimately gets populated into
app/src/Config/DatabaseConfig.php, so I'm a smidge reticent to just overwrite that file with a pre-populated one, not to mention the fact that this wouldn't REALLY be all THAT much better, from an administrative perspective Where did you see this?
Docker compose docs on secrets
Community interest
Last edited:
