More secure file-based provision of sensitive values
Sensitive values such as passwords, api keys, tokens, JWT secrets, etc. can easily be leaked when provided directly as environment variables.
For reference and more details why environment variables are a poor choice for providing secrets read for example https://blog.diogomonica.com/2017/03/27/why-you-shouldnt-use-env-variables-for-secret-data/
Add support for _FILE-suffixed environment variables for sensitive values
To still allow configuration via the environment but securely load secrets from files add support for additional environment variables that ("magically") load the secrets from file. The common pattern seems to be the add a _FILE suffixed environment variable for each such environment variable.
An example how this looks elsewhere: https://www.authelia.com/configuration/methods/secrets/
This allows to provide file paths via the environment and use container secrets, systemd credentials or similar mechanisms to provide sensitive values more securely.
More secure file-based provision of sensitive values
Sensitive values such as passwords, api keys, tokens, JWT secrets, etc. can easily be leaked when provided directly as environment variables.
For reference and more details why environment variables are a poor choice for providing secrets read for example https://blog.diogomonica.com/2017/03/27/why-you-shouldnt-use-env-variables-for-secret-data/
Add support for
_FILE-suffixed environment variables for sensitive valuesTo still allow configuration via the environment but securely load secrets from files add support for additional environment variables that ("magically") load the secrets from file. The common pattern seems to be the add a
_FILEsuffixed environment variable for each such environment variable.An example how this looks elsewhere: https://www.authelia.com/configuration/methods/secrets/
This allows to provide file paths via the environment and use container secrets, systemd credentials or similar mechanisms to provide sensitive values more securely.