Docker secrets integration

This commit is contained in:
Paweł Malak 2021-12-02 16:43:13 +01:00
parent d1d32cdbe6
commit 48b91581b8
10 changed files with 21753 additions and 111 deletions

View file

@ -4,7 +4,7 @@ WORKDIR /app
COPY package*.json ./ COPY package*.json ./
RUN apk --no-cache --virtual build-dependencies add python make g++ \ RUN apk --no-cache --virtual build-dependencies add python python3 make g++ \
&& npm install --production && npm install --production
COPY . . COPY . .

View file

@ -1,19 +1,22 @@
version: "3" version: '3.6'
secrets:
password:
file: ./secrets/password
services: services:
flame: flame:
image: pawelmalak/flame image: pawelmalak/flame
container_name: flame container_name: flame
volumes: volumes:
- /path/to/data:/app/data - /path/to/host/data:/app/data
# - /var/run/docker.sock:/var/run/docker.sock # optional but required for Docker integration
ports: ports:
- 5005:5005 - 5005:5005
secrets: # secrets:
- password # - password # optional but required for (1)
environment: environment:
- PASSWORD_FILE=/run/secrets/password - PASSWORD=flame_password
# - PASSWORD_FILE=/run/secrets/password # optional but required for (1)
restart: unless-stopped restart: unless-stopped
# optional but required for Docker secrets (1)
# secrets:
# password:
# file: /path/to/secrets/password

View file

@ -1 +0,0 @@
flame_docker_secret_password

View file

@ -1 +1,2 @@
*.md *.md
docker-compose.yml

View file

@ -55,24 +55,43 @@ docker buildx build \
#### Docker-Compose #### Docker-Compose
```yaml ```yaml
version: '2.1' version: '3.6'
services: services:
flame: flame:
image: pawelmalak/flame:latest image: pawelmalak/flame
container_name: flame container_name: flame
volumes: volumes:
- <host_dir>:/app/data - /path/to/host/data:/app/data
- /var/run/docker.sock:/var/run/docker.sock # optional but required for Docker integration feature - /var/run/docker.sock:/var/run/docker.sock # optional but required for Docker integration
ports: ports:
- 5005:5005 - 5005:5005
secrets:
- password # optional but required for (1)
environment: environment:
- PASSWORD=flame_password - PASSWORD=flame_password
- PASSWORD_FILE=/run/secrets/password # optional but required for (1)
restart: unless-stopped restart: unless-stopped
# optional but required for Docker secrets (1)
secrets:
password:
file: /path/to/secrets/password
``` ```
##### Docker Secrets ##### Docker Secrets
All environment variables set can be overwritten by appending `_FILE` to the variable value.For example, you can use `PASSWORD_FILE` to pass through a docker secret instead of `PASSWORD`. If both `PASSWORD` and `PASSWORD_FILE` are set, the docker secret will take precedent. An example using docker secrets is available in [here](.docker/docker-compose.yml). All environment variables can be overwritten by appending `_FILE` to the variable value. For example, you can use `PASSWORD_FILE` to pass through a docker secret instead of `PASSWORD`. If both `PASSWORD` and `PASSWORD_FILE` are set, the docker secret will take precedent.
```bash
# ./secrets/flame_password
my_custom_secret_password_123
# ./docker-compose.yml
secrets:
password:
file: ./secrets/flame_password
```
#### Skaffold #### Skaffold

21793
client/package-lock.json generated

File diff suppressed because it is too large Load diff

View file

@ -11,7 +11,6 @@
"@types/jest": "^27.0.2", "@types/jest": "^27.0.2",
"@types/node": "^16.11.6", "@types/node": "^16.11.6",
"@types/react": "^17.0.34", "@types/react": "^17.0.34",
"@types/react-autosuggest": "^10.1.5",
"@types/react-beautiful-dnd": "^13.1.2", "@types/react-beautiful-dnd": "^13.1.2",
"@types/react-dom": "^17.0.11", "@types/react-dom": "^17.0.11",
"@types/react-redux": "^7.1.20", "@types/react-redux": "^7.1.20",
@ -21,7 +20,6 @@
"http-proxy-middleware": "^2.0.1", "http-proxy-middleware": "^2.0.1",
"jwt-decode": "^3.1.2", "jwt-decode": "^3.1.2",
"react": "^17.0.2", "react": "^17.0.2",
"react-autosuggest": "^10.1.0",
"react-beautiful-dnd": "^13.1.0", "react-beautiful-dnd": "^13.1.0",
"react-dom": "^17.0.2", "react-dom": "^17.0.2",
"react-redux": "^7.2.6", "react-redux": "^7.2.6",

View file

@ -1,5 +1,4 @@
const ErrorResponse = require('../utils/ErrorResponse'); const ErrorResponse = require('../utils/ErrorResponse');
const colors = require('colors');
const Logger = require('../utils/Logger'); const Logger = require('../utils/Logger');
const logger = new Logger(); const logger = new Logger();

View file

@ -1,9 +1,9 @@
const initConfig = require('./initConfig'); const initConfig = require('./initConfig');
const initFiles = require('./initFiles'); const initFiles = require('./initFiles');
const initSecrets = require('./initSecrets'); const initDockerSecrets = require('./initDockerSecrets');
const initApp = async () => { const initApp = async () => {
initSecrets(); initDockerSecrets();
await initFiles(); await initFiles();
await initConfig(); await initConfig();
}; };

View file

@ -2,14 +2,16 @@ const { getSecrets } = require('docker-secret');
const Logger = require('../Logger'); const Logger = require('../Logger');
const logger = new Logger(); const logger = new Logger();
const initSecrets = () => { const initDockerSecrets = () => {
const secrets = getSecrets(); const secrets = getSecrets();
for (const property in secrets) { for (const property in secrets) {
const upperProperty = property.toUpperCase(); const upperProperty = property.toUpperCase();
process.env[upperProperty] = secrets[property]; process.env[upperProperty] = secrets[property];
logger.log(`${upperProperty} was overwritten with docker secret value`, 'WARN');
logger.log(`${upperProperty} was overwritten with docker secret value`);
} }
}; };
module.exports = initSecrets; module.exports = initDockerSecrets;