LuckPerms

LuckPerms

Mods
905k Downloads

Is there a way to use postgres' passfile instead of clear password?

MaxLevs opened this issue ยท 2 comments

commented

Description

Postgres lets you a way to configure password with passfile. There are a lot of services that allow you to use that file instead a clear password (by specifing pass file in environment variable with _FILE in the end of name). That gives a way to use secrets in e.x. docker. Clear way can leed to password leaks from docker ispection.

Do you have this feature too?

Proposed Behaviour

Database password can be set by changing LUCKPERMS_DATA_PASSWORD environment variable right now.
I suppose to add LUCKPERMS_DATA_PASSWORD_FILE environment variable to make it possible to povide service with password in more secure way.

Extra Details

I beleve that this feature can be not only used with Postgres but another databases too

commented

something like LUCKPERMS_DATA_PASSWORD=$(cat password_file.txt) should work on unix based systems

commented

It isn't what I mean. If it is about just storing password in some file and use it than yes this way will come in handy.
But I'm talking about secrets.

Links:
https://docs.docker.com/compose/compose-file/09-secrets/
https://docs.docker.com/compose/use-secrets/

For example if you declare a secrets section in compose file like this

secrets:
   db_password:
     file: db_password.txt

You will literally have this value in file by path /run/secrets/db_password and your app can read the file and get a password.

environment:
       DB_PASSWORD_FILE: /run/secrets/db_password