starred/pocket-id-pocket-id-2
1
0
Fork 0
mirror of https://github.com/pocket-id/pocket-id.git synced 2025-12-09 14:42:59 +03:00
Code Issues 116 Packages Projects Releases 10 Wiki Activity

[PR #799] [MERGED] feat: support reading secret env vars from _FILE #619

New Issue
Closed
opened 2025-10-09 16:53:53 +03:00 by OVERLORD · 0 comments
OVERLORD commented 2025-10-09 16:53:53 +03:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/pocket-id/pocket-id/pull/799
Author: @ItalyPaleAle
Created: 7/30/2025
Status: ✅ Merged
Merged: 7/30/2025
Merged by: @kmendell

Base: main ← Head: secret-files

📝 Commits (6)

  • e820431 feat: support reading secret env vars from _FILE
  • 5efa7c1 Merge branch 'main' into secret-files
  • c5e22aa trim white space from env files
  • d12c1a0 make helper for parsing strings or file based env variables
  • bae3e5e only trim the endings of strings, new lines, returns, and spaces
  • d5ba5e7 Do not trim spaces for the encryption key

📊 Changes

4 files changed (+103 additions, -47 deletions)

View changed files

📝 backend/internal/common/env_config.go (+82 -25)
📝 backend/internal/model/app_config.go (+2 -2)
📝 backend/internal/service/app_config_service.go (+16 -5)
📝 backend/internal/utils/jwk/utils.go (+3 -15)

📄 Description

Fixes #685

Env vars that contain secret values now can be read from file. To do that, pass the env var *_FILE containing the path to a file on disk. This works with Docker (and K8s) secrets too, since they are mounted as files.

These env vars are currently supported:

  • EnvConfig:
    • DB_CONNECTION_STRING_FILE
    • MAXMIND_LICENSE_KEY_FILE
    • Additionally, ENCRYPTION_KEY_FILE was already available
  • AppConfig (when UI configuration is disabled): all values that have the sensitive tag in the struct, which currently includes:
    • SMTP_PASSWORD_FILE
    • LDAP_BIND_PASSWORD_FILE

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/pocket-id/pocket-id/pull/799 **Author:** [@ItalyPaleAle](https://github.com/ItalyPaleAle) **Created:** 7/30/2025 **Status:** ✅ Merged **Merged:** 7/30/2025 **Merged by:** [@kmendell](https://github.com/kmendell) **Base:** `main` ← **Head:** `secret-files` --- ### 📝 Commits (6) - [`e820431`](https://github.com/pocket-id/pocket-id/commit/e820431609ff3a7b2aef45c5fb91262c81367fe4) feat: support reading secret env vars from _FILE - [`5efa7c1`](https://github.com/pocket-id/pocket-id/commit/5efa7c17dd6b3de0463fadb6e114735fa4a0862d) Merge branch 'main' into secret-files - [`c5e22aa`](https://github.com/pocket-id/pocket-id/commit/c5e22aabaf165abdad9dc854f02368cdd213dfa5) trim white space from env files - [`d12c1a0`](https://github.com/pocket-id/pocket-id/commit/d12c1a0dc386f70c582821968ec0ed554bad0aa1) make helper for parsing strings or file based env variables - [`bae3e5e`](https://github.com/pocket-id/pocket-id/commit/bae3e5e63b40563a543d449bae9fc4acf5f3467f) only trim the endings of strings, new lines, returns, and spaces - [`d5ba5e7`](https://github.com/pocket-id/pocket-id/commit/d5ba5e7fbd373dcfaa8648b8f2b7337ad6edd85d) Do not trim spaces for the encryption key ### 📊 Changes **4 files changed** (+103 additions, -47 deletions) <details> <summary>View changed files</summary> 📝 `backend/internal/common/env_config.go` (+82 -25) 📝 `backend/internal/model/app_config.go` (+2 -2) 📝 `backend/internal/service/app_config_service.go` (+16 -5) 📝 `backend/internal/utils/jwk/utils.go` (+3 -15) </details> ### 📄 Description Fixes #685 Env vars that contain secret values now can be read from file. To do that, pass the env var `*_FILE` containing the path to a file on disk. This works with Docker (and K8s) secrets too, since they are mounted as files. These env vars are currently supported: - EnvConfig: - `DB_CONNECTION_STRING_FILE` - `MAXMIND_LICENSE_KEY_FILE` - Additionally, `ENCRYPTION_KEY_FILE` was already available - AppConfig (when UI configuration is disabled): all values that have the `sensitive` tag in the struct, which currently includes: - `SMTP_PASSWORD_FILE` - `LDAP_BIND_PASSWORD_FILE` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
OVERLORD added the pull-request label 2025-10-09 16:53:53 +03:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
breaking
bug
documentation
feature
needs more upvotes
open to pull requests
pull-request
Mirrored from GitHub Pull Request
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/pocket-id-pocket-id-2#619
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?