Mobilizon issueshttps://framagit.org/framasoft/mobilizon/-/issues2024-03-13T18:25:36Zhttps://framagit.org/framasoft/mobilizon/-/issues/1292Support Docker Secrets for sensitive environment variables2024-03-13T18:25:36ZMark MonteiroSupport Docker Secrets for sensitive environment variablesStoring sensitive information using environment variables is less secure than using [Docker Secrets](https://docs.docker.com/engine/swarm/secrets/). It is a common practice among many docker images to support an alternative environment v...Storing sensitive information using environment variables is less secure than using [Docker Secrets](https://docs.docker.com/engine/swarm/secrets/). It is a common practice among many docker images to support an alternative environment variable with a _FILE suffix that loads the value from using the contents of a file mounted into the container.
For example, the `MOBILIZON_DATABASE_PASSWORD` variable should also have an equivalent `MOBILIZON_DATABASE_PASSWORD_FILE` variable. The user sets this _FILE variable to the path of a file containing the value for `MOBILIZON_DATABASE_PASSWORD`. If using Docker secrets, the file will be mounted into /run/secrets, so the user might set it to something like `MOBILIZON_DATABASE_PASSWORD_FILE=/run/secrets/DB_PASSWORD`. If a value for the _FILE variable is set, then the contents of the specified file need to be read and loaded into the associated environment variable by Mobilizon. Here is an example of how this was implemented in the Postgres Docker image: https://github.com/docker-library/postgres/pull/225/files
For this project, here are some of the environment variables that should probably support this (NOTE: I did not review all the supported environment variables, just the ones I am using in my own setup):
- MOBILIZON_DATABASE_USERNAME
- MOBILIZON_DATABASE_PASSWORD
- MOBILIZON_DATABASE_DBNAME
- MOBILIZON_INSTANCE_SECRET_KEY_BASE
- MOBILIZON_INSTANCE_SECRET_KEY
- MOBILIZON_SMTP_USERNAME
- MOBILIZON_SMTP_PASSWORD
- MOBILIZON_LDAP_BIND_UID
- MOBILIZON_LDAP_BIND_PASSWORD
- MOBILIZON_NOMINATIM_API_KEY
- MOBILIZON_WEB_PUSH_PUBLIC_KEY
- MOBILIZON_WEB_PUSH_PRIVATE_KEY
- others?