Better handling of sensitive config values
starcraft66 opened this issue ยท 3 comments
Why?
I've started running a minecraft server and I am deploying it on Kubernetes using the GitOps methodology. All of the configuration for my server is located here. For such a deployment, I need to encrypt sensitive values in the git repo such as the discord bot token DiscordSRV requires to function.
I currently store all of DiscordSRV's config files in a kubernetes ConfigMap and mount them into the appropriate folder.
The annoyance I'm experiencing is that I currently have to store the entire config.yml
file in a kubernetes Secret that I then encrypt.
What and How?
I think a cleaner approach to handling sensitive config values such as the bot token would be to create a separate config file for those values only. Alternatively, letting them be overridden by environment variables would work well too as environment variables can be injected into a container from a kubernetes Secret or ConfigMap.
Are there alternatives?
N/A
Checks
- I have used the search at least once to check if my idea has already been suggested and perhaps already implemented.
Anything else
No response
Currently there are a few existing ways to enter the bot token in a sensitive manner. A file named .token
can be placed in the DiscordSRV folder containing just the token, which DiscordSRV will read from. You can also use both system or environment variables (DISCORDSRV_TOKEN
) to supply the token to DiscordSRV. Related code lines: https://github.com/DiscordSRV/DiscordSRV/blob/develop/src/main/java/github/scarsz/discordsrv/DiscordSRV.java#L848-L867
Thank you, that's exactly what I need. Are these mentioned in the docs? I must have skimmed over them or missed them.