PWPUSH_MASTER_KEY docker secret howto

[jonnjonzzn]

Is there a way to use the env variable PWPUSH_MASTER_KEY with a docker secret?

[pglombardo]

Hi @jonnjonzzn - we don't have support for docker secrets yet but it looks easy to add.

If I read the docs correctly, docker secrets will place a file into the container in /run/secrets. So if you created a secret named pwpush_master_key, it would show up as /run/secrets/pwpush_master_key.

If this is the case, I can add a startup check for that file and if it exists, take the value and set export PWPUSH_MASTER_KEY=<value>....

Let me know what you think. I don't have Docker swarm so I wouldn't be able to test it.

[jonnjonzzn]

Ah, OK. That sounds reasonable. Great even :-)

Could this also extend to something like the following:

(docker-compose.override.yaml snippet):

POSTGRES_PASSWORD_FILE: /run/secrets/POSTGRES_PASSWORD
POSTGRES_PASSWORD: ''

Right now I'm getting when attempting this:

PG::ConnectionBad: FATAL: password authentication failed for user "passwordpusher_user"

The postgresql container comes up fine though.

[jonnjonzzn]

The connection issue actually happens anytime I try to change the default POSTGRES_PASSWORD (using docker-compose.override file). Even if just changing the password in the file itself.

I feel I've hijacked this thread unfairly, if so I'll start a new one regarding changing postgresql password.

[pglombardo]

Hey @jonnjonzzn that POSTGRES_PASSWORD_FILE is only supported in the postgres container itself.

To change credentials in the pwpush container, they are contained in the DATABASE_URL environment variable. Adding docker secrets support to that would be a separate request entirely. That one doesn't seem as easy to do...