hasura/graphql-engine

Add support for Docker Secrets by reading secrets files

Open

#3989 opened on Mar 2, 2020

View on GitHub
 (19 comments) (27 reactions) (1 assignee)TypeScript (31,371 stars) (2,787 forks)batch import
a/securityc/serverhelp wantedk/enhancement

Description

Currently, the only way to pass secrets (DB credentials, Hasura admin secret) to Hasura is only by environment variables. For users of Docker Compose or Docker Swarm, this means these secrets have to be stored in plaintext, which presents security risks.

It would be great to build support for Docker Secrets (or even Vault), by adding the following environment variables, as recommended by Docker:

  • HASURA_GRAPHQL_ACCESS_KEY_FILE
  • HASURA_GRAPHQL_DATABASE_URL_FILE

If these variables are present, the access key and DB URL should be read from the corresponding files.

Docs: https://docs.docker.com/engine/swarm/secrets/#build-support-for-docker-secrets-into-your-images

Contributor guide

Tech stack
typescriptnodejsgraphqldocker
Domain
backendsecurityinfrastructure
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
Familiarity with Hasura configurationDocker basicsFile I/O in Node.jsEnvironment variable handling
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
55
Research direction
Investigate the current environment variable loading mechanism in the Hasura GraphQL Engine codebase, likely in the server startup scripts or configuration module. Look for existing handling of HASURA GRAPHQL ACCESS KEY and HASURA GRAPHQL DATABASE URL. Implement logic to check for the FILE variants and read the contents from the specified file paths. Review Docker documentation for best practices. Consider edge cases like missing files, permissions, and relative paths. The issue has 19 comments that may contain additional guidance.