Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Docker Secrets Support #161

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Add Docker Secrets Support #161

wants to merge 2 commits into from

Conversation

GAS85
Copy link

@GAS85 GAS85 commented Jun 27, 2023

Documentation Update
Add more examples to the compose

Now any Variable that set with _FILE at the end will be treated as Docker Secret.

Documentation Update
Add more examples to the compose
@vogler
Copy link
Owner

vogler commented Jun 27, 2023

What's the benefit of this over putting your sensitive data in data/config.env (loaded first by dotenv) and everything non-sensitive in the docker-compose.yml (overwrites via env)?

@@ -13,3 +24,30 @@ services:
environment:
# - EMAIL=foo@bar.org
# - NOTIFY='tgram://...'
# - NOTIFY_TITLE="Optional title for notifications"
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't want another place to keep options in sync besides config.js and README.md.
Is this useful for some software to offer a template? (There's already some external Unraid template.)

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That is a good wish. I can remove them, but at least compose example should be copy-paste working, so that it contains basic needed data.

@GAS85
Copy link
Author

GAS85 commented Jun 28, 2023

What's the benefit of this over putting your sensitive data in data/config.env (loaded first by dotenv) and everything non-sensitive in the docker-compose.yml (overwrites via env)?

There is no clear benefit if I read documentation carefully before to do it 😵‍💫. I didn't know that this was supported, sorry for that.

Probably that was caused by my own setup, I do share some Secrets across containers with docker secrets feature, so that I simply need to declare them additionally in a yaml file.

  1. E.g. in this case if I have multiple fgc's containers I can setup only once VNC password and do no copy it into the env file across different data directories.
  2. I bound few containers together (e.g. own dedicated network via network_mode and depends_on), in this case sometimes docker health checks should be performed in a way that you do not call local container service, but calling local service via other container route and you could need's credentials to authorize yourself in this case. Those credentials are shared as secrets over containers.

To be honest I do not like docker secrets implementation, rather as it is done in kubernetes - you declare secret, it is variable, not a file, that you need to read and import.

@@ -13,6 +13,34 @@ rm -f /fgc/data/browser/SingletonLock
# ls -l /tmp/.X11-unix/
rm -f /tmp/.X1-lock

# Check and export secrets to variables if exist
# Get list of VARIABLES with "_FILE" at the end
SECRETS_LIST=$(env | grep "_FILE")
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought also to limit those to only credentials and add here whitelist, e.g. PASSWORD_FILE, EMAIL_FILE, OTP_FILE.

grep -E "PASSWORD_FILE|EMAIL_FILE|OTP_FILE"

Add non secrets example.
Move to generic variables
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants