Skip to content

Commit 1f46ed0

Browse files
mabeettmabeett
committed
Secrets handling via entrypoint
Secrets files handled only in the entrypoint, converted during initial execuition. Solves #1148 Signed-off-by: Matías Pecchia <179218+mabeett@users.noreply.github.com>
1 parent 65138b6 commit 1f46ed0

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

50 files changed

+280
-330
lines changed

‎.config/autoconfig.php

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -6,27 +6,13 @@
66
$AUTOCONFIG['dbtype'] = 'sqlite';
77
$AUTOCONFIG['dbname'] = getenv('SQLITE_DATABASE');
88
$autoconfig_enabled = true;
9-
} elseif (getenv('MYSQL_DATABASE_FILE') && getenv('MYSQL_USER_FILE') && getenv('MYSQL_PASSWORD_FILE') && getenv('MYSQL_HOST')) {
10-
$AUTOCONFIG['dbtype'] = 'mysql';
11-
$AUTOCONFIG['dbname'] = trim(file_get_contents(getenv('MYSQL_DATABASE_FILE')));
12-
$AUTOCONFIG['dbuser'] = trim(file_get_contents(getenv('MYSQL_USER_FILE')));
13-
$AUTOCONFIG['dbpass'] = trim(file_get_contents(getenv('MYSQL_PASSWORD_FILE')));
14-
$AUTOCONFIG['dbhost'] = getenv('MYSQL_HOST');
15-
$autoconfig_enabled = true;
169
} elseif (getenv('MYSQL_DATABASE') && getenv('MYSQL_USER') && getenv('MYSQL_PASSWORD') && getenv('MYSQL_HOST')) {
1710
$AUTOCONFIG['dbtype'] = 'mysql';
1811
$AUTOCONFIG['dbname'] = getenv('MYSQL_DATABASE');
1912
$AUTOCONFIG['dbuser'] = getenv('MYSQL_USER');
2013
$AUTOCONFIG['dbpass'] = getenv('MYSQL_PASSWORD');
2114
$AUTOCONFIG['dbhost'] = getenv('MYSQL_HOST');
2215
$autoconfig_enabled = true;
23-
} elseif (getenv('POSTGRES_DB_FILE') && getenv('POSTGRES_USER_FILE') && getenv('POSTGRES_PASSWORD_FILE') && getenv('POSTGRES_HOST')) {
24-
$AUTOCONFIG['dbtype'] = 'pgsql';
25-
$AUTOCONFIG['dbname'] = trim(file_get_contents(getenv('POSTGRES_DB_FILE')));
26-
$AUTOCONFIG['dbuser'] = trim(file_get_contents(getenv('POSTGRES_USER_FILE')));
27-
$AUTOCONFIG['dbpass'] = trim(file_get_contents(getenv('POSTGRES_PASSWORD_FILE')));
28-
$AUTOCONFIG['dbhost'] = getenv('POSTGRES_HOST');
29-
$autoconfig_enabled = true;
3016
} elseif (getenv('POSTGRES_DB') && getenv('POSTGRES_USER') && getenv('POSTGRES_PASSWORD') && getenv('POSTGRES_HOST')) {
3117
$AUTOCONFIG['dbtype'] = 'pgsql';
3218
$AUTOCONFIG['dbname'] = getenv('POSTGRES_DB');

‎.config/redis.config.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
'memcache.locking' => '\OC\Memcache\Redis',
66
'redis' => array(
77
'host' => getenv('REDIS_HOST'),
8-
'password' => getenv('REDIS_HOST_PASSWORD_FILE') ? trim(file_get_contents(getenv('REDIS_HOST_PASSWORD_FILE'))) : (string) getenv('REDIS_HOST_PASSWORD'),
8+
'password' => (string) getenv('REDIS_HOST_PASSWORD'),
99
),
1010
);
1111

‎.config/s3.config.php

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -24,25 +24,19 @@
2424
)
2525
);
2626

27-
if (getenv('OBJECTSTORE_S3_KEY_FILE')) {
28-
$CONFIG['objectstore']['arguments']['key'] = trim(file_get_contents(getenv('OBJECTSTORE_S3_KEY_FILE')));
29-
} elseif (getenv('OBJECTSTORE_S3_KEY')) {
27+
if (getenv('OBJECTSTORE_S3_KEY')) {
3028
$CONFIG['objectstore']['arguments']['key'] = getenv('OBJECTSTORE_S3_KEY');
3129
} else {
3230
$CONFIG['objectstore']['arguments']['key'] = '';
3331
}
3432

35-
if (getenv('OBJECTSTORE_S3_SECRET_FILE')) {
36-
$CONFIG['objectstore']['arguments']['secret'] = trim(file_get_contents(getenv('OBJECTSTORE_S3_SECRET_FILE')));
37-
} elseif (getenv('OBJECTSTORE_S3_SECRET')) {
33+
if (getenv('OBJECTSTORE_S3_SECRET')) {
3834
$CONFIG['objectstore']['arguments']['secret'] = getenv('OBJECTSTORE_S3_SECRET');
3935
} else {
4036
$CONFIG['objectstore']['arguments']['secret'] = '';
4137
}
4238

43-
if (getenv('OBJECTSTORE_S3_SSE_C_KEY_FILE')) {
44-
$CONFIG['objectstore']['arguments']['sse_c_key'] = trim(file_get_contents(getenv('OBJECTSTORE_S3_SSE_C_KEY_FILE')));
45-
} elseif (getenv('OBJECTSTORE_S3_SSE_C_KEY')) {
39+
if (getenv('OBJECTSTORE_S3_SSE_C_KEY')) {
4640
$CONFIG['objectstore']['arguments']['sse_c_key'] = getenv('OBJECTSTORE_S3_SSE_C_KEY');
4741
}
4842
}

‎.config/smtp.config.php

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,16 +5,14 @@
55
'mail_smtphost' => getenv('SMTP_HOST'),
66
'mail_smtpport' => getenv('SMTP_PORT') ?: (getenv('SMTP_SECURE') ? 465 : 25),
77
'mail_smtpsecure' => getenv('SMTP_SECURE') ?: '',
8-
'mail_smtpauth' => getenv('SMTP_NAME') && (getenv('SMTP_PASSWORD') || getenv('SMTP_PASSWORD_FILE')),
8+
'mail_smtpauth' => getenv('SMTP_NAME') && getenv('SMTP_PASSWORD'),
99
'mail_smtpauthtype' => getenv('SMTP_AUTHTYPE') ?: 'LOGIN',
1010
'mail_smtpname' => getenv('SMTP_NAME') ?: '',
1111
'mail_from_address' => getenv('MAIL_FROM_ADDRESS'),
1212
'mail_domain' => getenv('MAIL_DOMAIN'),
1313
);
1414

15-
if (getenv('SMTP_PASSWORD_FILE')) {
16-
$CONFIG['mail_smtppassword'] = trim(file_get_contents(getenv('SMTP_PASSWORD_FILE')));
17-
} elseif (getenv('SMTP_PASSWORD')) {
15+
if (getenv('SMTP_PASSWORD')) {
1816
$CONFIG['mail_smtppassword'] = getenv('SMTP_PASSWORD');
1917
} else {
2018
$CONFIG['mail_smtppassword'] = '';

‎27/apache/config/autoconfig.php

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -6,27 +6,13 @@
66
$AUTOCONFIG['dbtype'] = 'sqlite';
77
$AUTOCONFIG['dbname'] = getenv('SQLITE_DATABASE');
88
$autoconfig_enabled = true;
9-
} elseif (getenv('MYSQL_DATABASE_FILE') && getenv('MYSQL_USER_FILE') && getenv('MYSQL_PASSWORD_FILE') && getenv('MYSQL_HOST')) {
10-
$AUTOCONFIG['dbtype'] = 'mysql';
11-
$AUTOCONFIG['dbname'] = trim(file_get_contents(getenv('MYSQL_DATABASE_FILE')));
12-
$AUTOCONFIG['dbuser'] = trim(file_get_contents(getenv('MYSQL_USER_FILE')));
13-
$AUTOCONFIG['dbpass'] = trim(file_get_contents(getenv('MYSQL_PASSWORD_FILE')));
14-
$AUTOCONFIG['dbhost'] = getenv('MYSQL_HOST');
15-
$autoconfig_enabled = true;
169
} elseif (getenv('MYSQL_DATABASE') && getenv('MYSQL_USER') && getenv('MYSQL_PASSWORD') && getenv('MYSQL_HOST')) {
1710
$AUTOCONFIG['dbtype'] = 'mysql';
1811
$AUTOCONFIG['dbname'] = getenv('MYSQL_DATABASE');
1912
$AUTOCONFIG['dbuser'] = getenv('MYSQL_USER');
2013
$AUTOCONFIG['dbpass'] = getenv('MYSQL_PASSWORD');
2114
$AUTOCONFIG['dbhost'] = getenv('MYSQL_HOST');
2215
$autoconfig_enabled = true;
23-
} elseif (getenv('POSTGRES_DB_FILE') && getenv('POSTGRES_USER_FILE') && getenv('POSTGRES_PASSWORD_FILE') && getenv('POSTGRES_HOST')) {
24-
$AUTOCONFIG['dbtype'] = 'pgsql';
25-
$AUTOCONFIG['dbname'] = trim(file_get_contents(getenv('POSTGRES_DB_FILE')));
26-
$AUTOCONFIG['dbuser'] = trim(file_get_contents(getenv('POSTGRES_USER_FILE')));
27-
$AUTOCONFIG['dbpass'] = trim(file_get_contents(getenv('POSTGRES_PASSWORD_FILE')));
28-
$AUTOCONFIG['dbhost'] = getenv('POSTGRES_HOST');
29-
$autoconfig_enabled = true;
3016
} elseif (getenv('POSTGRES_DB') && getenv('POSTGRES_USER') && getenv('POSTGRES_PASSWORD') && getenv('POSTGRES_HOST')) {
3117
$AUTOCONFIG['dbtype'] = 'pgsql';
3218
$AUTOCONFIG['dbname'] = getenv('POSTGRES_DB');

‎27/apache/config/redis.config.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
'memcache.locking' => '\OC\Memcache\Redis',
66
'redis' => array(
77
'host' => getenv('REDIS_HOST'),
8-
'password' => getenv('REDIS_HOST_PASSWORD_FILE') ? trim(file_get_contents(getenv('REDIS_HOST_PASSWORD_FILE'))) : (string) getenv('REDIS_HOST_PASSWORD'),
8+
'password' => (string) getenv('REDIS_HOST_PASSWORD'),
99
),
1010
);
1111

‎27/apache/config/s3.config.php

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -24,25 +24,19 @@
2424
)
2525
);
2626

27-
if (getenv('OBJECTSTORE_S3_KEY_FILE')) {
28-
$CONFIG['objectstore']['arguments']['key'] = trim(file_get_contents(getenv('OBJECTSTORE_S3_KEY_FILE')));
29-
} elseif (getenv('OBJECTSTORE_S3_KEY')) {
27+
if (getenv('OBJECTSTORE_S3_KEY')) {
3028
$CONFIG['objectstore']['arguments']['key'] = getenv('OBJECTSTORE_S3_KEY');
3129
} else {
3230
$CONFIG['objectstore']['arguments']['key'] = '';
3331
}
3432

35-
if (getenv('OBJECTSTORE_S3_SECRET_FILE')) {
36-
$CONFIG['objectstore']['arguments']['secret'] = trim(file_get_contents(getenv('OBJECTSTORE_S3_SECRET_FILE')));
37-
} elseif (getenv('OBJECTSTORE_S3_SECRET')) {
33+
if (getenv('OBJECTSTORE_S3_SECRET')) {
3834
$CONFIG['objectstore']['arguments']['secret'] = getenv('OBJECTSTORE_S3_SECRET');
3935
} else {
4036
$CONFIG['objectstore']['arguments']['secret'] = '';
4137
}
4238

43-
if (getenv('OBJECTSTORE_S3_SSE_C_KEY_FILE')) {
44-
$CONFIG['objectstore']['arguments']['sse_c_key'] = trim(file_get_contents(getenv('OBJECTSTORE_S3_SSE_C_KEY_FILE')));
45-
} elseif (getenv('OBJECTSTORE_S3_SSE_C_KEY')) {
39+
if (getenv('OBJECTSTORE_S3_SSE_C_KEY')) {
4640
$CONFIG['objectstore']['arguments']['sse_c_key'] = getenv('OBJECTSTORE_S3_SSE_C_KEY');
4741
}
4842
}

‎27/apache/config/smtp.config.php

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,16 +5,14 @@
55
'mail_smtphost' => getenv('SMTP_HOST'),
66
'mail_smtpport' => getenv('SMTP_PORT') ?: (getenv('SMTP_SECURE') ? 465 : 25),
77
'mail_smtpsecure' => getenv('SMTP_SECURE') ?: '',
8-
'mail_smtpauth' => getenv('SMTP_NAME') && (getenv('SMTP_PASSWORD') || getenv('SMTP_PASSWORD_FILE')),
8+
'mail_smtpauth' => getenv('SMTP_NAME') && getenv('SMTP_PASSWORD'),
99
'mail_smtpauthtype' => getenv('SMTP_AUTHTYPE') ?: 'LOGIN',
1010
'mail_smtpname' => getenv('SMTP_NAME') ?: '',
1111
'mail_from_address' => getenv('MAIL_FROM_ADDRESS'),
1212
'mail_domain' => getenv('MAIL_DOMAIN'),
1313
);
1414

15-
if (getenv('SMTP_PASSWORD_FILE')) {
16-
$CONFIG['mail_smtppassword'] = trim(file_get_contents(getenv('SMTP_PASSWORD_FILE')));
17-
} elseif (getenv('SMTP_PASSWORD')) {
15+
if (getenv('SMTP_PASSWORD')) {
1816
$CONFIG['mail_smtppassword'] = getenv('SMTP_PASSWORD');
1917
} else {
2018
$CONFIG['mail_smtppassword'] = '';

‎27/apache/entrypoint.sh

Lines changed: 22 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -63,14 +63,16 @@ file_env() {
6363
local varValue=$(env | grep -E "^${var}=" | sed -E -e "s/^${var}=//")
6464
local fileVarValue=$(env | grep -E "^${fileVar}=" | sed -E -e "s/^${fileVar}=//")
6565
if [ -n "${varValue}" ] && [ -n "${fileVarValue}" ]; then
66-
echo >&2 "error: both $var and $fileVar are set (but are exclusive)"
67-
exit 1
66+
echo "Warning: both $var and $fileVar are set ($fileVar takes precedence)"
6867
fi
69-
if [ -n "${varValue}" ]; then
70-
export "$var"="${varValue}"
71-
elif [ -n "${fileVarValue}" ]; then
68+
if [ -n "${fileVarValue}" ]; then
69+
echo "note: taking ${fileVar} file for ${var} value"
7270
export "$var"="$(cat "${fileVarValue}")"
71+
elif [ -n "${varValue}" ]; then
72+
echo "note: using ${var} variable for ${var} value"
73+
export "$var"="${varValue}"
7374
elif [ -n "${def}" ]; then
75+
echo "note: using invoked definition for ${var} value"
7476
export "$var"="$def"
7577
fi
7678
unset "$fileVar"
@@ -82,6 +84,21 @@ if expr "$1" : "apache" 1>/dev/null; then
8284
fi
8385
fi
8486

87+
# All possible content secrets to variable
88+
file_env NEXTCLOUD_ADMIN_PASSWORD
89+
file_env NEXTCLOUD_ADMIN_USER
90+
file_env MYSQL_DATABASE
91+
file_env MYSQL_PASSWORD
92+
file_env MYSQL_USER
93+
file_env POSTGRES_DB
94+
file_env POSTGRES_PASSWORD
95+
file_env POSTGRES_USER
96+
file_env REDIS_HOST_PASSWORD
97+
file_env SMTP_PASSWORD
98+
file_env OBJECTSTORE_S3_KEY
99+
file_env OBJECTSTORE_S3_SECRET
100+
file_env OBJECTSTORE_S3_SSE_C_KEY
101+
85102
if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UPDATE:-0}" -eq 1 ]; then
86103
uid="$(id -u)"
87104
gid="$(id -g)"

‎27/fpm-alpine/config/autoconfig.php

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -6,27 +6,13 @@
66
$AUTOCONFIG['dbtype'] = 'sqlite';
77
$AUTOCONFIG['dbname'] = getenv('SQLITE_DATABASE');
88
$autoconfig_enabled = true;
9-
} elseif (getenv('MYSQL_DATABASE_FILE') && getenv('MYSQL_USER_FILE') && getenv('MYSQL_PASSWORD_FILE') && getenv('MYSQL_HOST')) {
10-
$AUTOCONFIG['dbtype'] = 'mysql';
11-
$AUTOCONFIG['dbname'] = trim(file_get_contents(getenv('MYSQL_DATABASE_FILE')));
12-
$AUTOCONFIG['dbuser'] = trim(file_get_contents(getenv('MYSQL_USER_FILE')));
13-
$AUTOCONFIG['dbpass'] = trim(file_get_contents(getenv('MYSQL_PASSWORD_FILE')));
14-
$AUTOCONFIG['dbhost'] = getenv('MYSQL_HOST');
15-
$autoconfig_enabled = true;
169
} elseif (getenv('MYSQL_DATABASE') && getenv('MYSQL_USER') && getenv('MYSQL_PASSWORD') && getenv('MYSQL_HOST')) {
1710
$AUTOCONFIG['dbtype'] = 'mysql';
1811
$AUTOCONFIG['dbname'] = getenv('MYSQL_DATABASE');
1912
$AUTOCONFIG['dbuser'] = getenv('MYSQL_USER');
2013
$AUTOCONFIG['dbpass'] = getenv('MYSQL_PASSWORD');
2114
$AUTOCONFIG['dbhost'] = getenv('MYSQL_HOST');
2215
$autoconfig_enabled = true;
23-
} elseif (getenv('POSTGRES_DB_FILE') && getenv('POSTGRES_USER_FILE') && getenv('POSTGRES_PASSWORD_FILE') && getenv('POSTGRES_HOST')) {
24-
$AUTOCONFIG['dbtype'] = 'pgsql';
25-
$AUTOCONFIG['dbname'] = trim(file_get_contents(getenv('POSTGRES_DB_FILE')));
26-
$AUTOCONFIG['dbuser'] = trim(file_get_contents(getenv('POSTGRES_USER_FILE')));
27-
$AUTOCONFIG['dbpass'] = trim(file_get_contents(getenv('POSTGRES_PASSWORD_FILE')));
28-
$AUTOCONFIG['dbhost'] = getenv('POSTGRES_HOST');
29-
$autoconfig_enabled = true;
3016
} elseif (getenv('POSTGRES_DB') && getenv('POSTGRES_USER') && getenv('POSTGRES_PASSWORD') && getenv('POSTGRES_HOST')) {
3117
$AUTOCONFIG['dbtype'] = 'pgsql';
3218
$AUTOCONFIG['dbname'] = getenv('POSTGRES_DB');

0 commit comments

Comments
 (0)