FreshRSS/FreshRSS

[Feature] Ability to use docker secrets files

開放

#7,308 建立於 2025年2月6日

 (4 則留言) (1 個反應) (0 位負責人)PHP (1,171 個分叉)batch import
Docker 🐋Feature RequestSecurity :shield:help wanted

倉庫指標

星標
 (15,022 顆星)
PR 合併指標
 (平均合併 11天 12小時) (30 天內合併 36 個 PR)

描述

Is your feature request related to a problem? Please describe.

Of course it is low-priority request, but it would be nice if FreshRSS will add ability to use docker secrets instead of passwords in docker-compose.yml or .env file

Use case

It is security best practices. Also with the secrets it is possible to store config (compose file and variables) in git without compromising the security

Describe the solution you’d like

PSQL and MariaDB already have the ability to use the secrets. So, for Postges, you can use POSTGRES_DB_FILE, POSTGRES_PASSWORD_FILE and POSTGRES_USER_FILE variables instead of DB name, user name and password. So the FreshRSS just should only check those variables and if they set - use them

POSTGRES_DB_FILE=/run/secrets/psql_pass POSTGRES_USER_FILE=/run/secrets/psql_user POSTGRES_PASSWORD_FILE=/run/secrets/psql_dbname

Also it would be nice to hide in secrets ADMIN_PASSWORD and ADMIN_API_PASSWORD variables too

So, if ADMIN_PASSWORD=aaaa was specified, use it. Else if ADMIN_PASSWORD_FILE=/run/secrets/admin_pass variable was specified, we should use the pass from /run/secrets/admin_pass

Describe alternatives you’ve considered

No response

Additional context

No response

貢獻者指南