aboutsummaryrefslogtreecommitdiff
path: root/src/util/config.rs
diff options
context:
space:
mode:
authorAlex <alex@adnab.me>2023-10-19 09:33:12 +0000
committerAlex <alex@adnab.me>2023-10-19 09:33:12 +0000
commit0215b114028c9a9987c1581e50820a42e069ffe5 (patch)
tree5d388a9643d5474b914b7f261c72c21142d8c592 /src/util/config.rs
parente75fe2157d0973eb4320bbc87be5e54a1cb91a63 (diff)
parent8599051c492d7df22305e4c65659395d9102955c (diff)
downloadgarage-0215b114028c9a9987c1581e50820a42e069ffe5.tar.gz
garage-0215b114028c9a9987c1581e50820a42e069ffe5.zip
Merge pull request 'Add support for specifying `rpc_secret_file`, `metrics_token_file` and `admin_token_file` using environment variables' (#643) from networkException/garage:token-file-env into main-0.8.x
Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/643
Diffstat (limited to 'src/util/config.rs')
-rw-r--r--src/util/config.rs35
1 files changed, 19 insertions, 16 deletions
diff --git a/src/util/config.rs b/src/util/config.rs
index ebcb5fbe..756f7ec5 100644
--- a/src/util/config.rs
+++ b/src/util/config.rs
@@ -238,6 +238,24 @@ pub fn read_config(config_file: PathBuf) -> Result<Config, Error> {
Ok(parsed_config)
}
+pub fn read_secret_file(file_path: &String) -> Result<String, Error> {
+ #[cfg(unix)]
+ if std::env::var("GARAGE_ALLOW_WORLD_READABLE_SECRETS").as_deref() != Ok("true") {
+ use std::os::unix::fs::MetadataExt;
+ let metadata = std::fs::metadata(file_path)?;
+ if metadata.mode() & 0o077 != 0 {
+ return Err(format!("File {} is world-readable! (mode: 0{:o}, expected 0600)\nRefusing to start until this is fixed, or environment variable GARAGE_ALLOW_WORLD_READABLE_SECRETS is set to true.", file_path, metadata.mode()).into());
+ }
+ }
+ let mut file = std::fs::OpenOptions::new().read(true).open(file_path)?;
+ let mut secret_buf = String::new();
+ file.read_to_string(&mut secret_buf)?;
+
+ // trim_end: allows for use case such as `echo "$(openssl rand -hex 32)" > somefile`.
+ // also editors sometimes add a trailing newline
+ Ok(String::from(secret_buf.trim_end()))
+}
+
fn secret_from_file(
secret: &mut Option<String>,
secret_file: &Option<String>,
@@ -250,22 +268,7 @@ fn secret_from_file(
(Some(_), Some(_)) => {
return Err(format!("only one of `{}` and `{}_file` can be set", name, name).into());
}
- (None, Some(file_path)) => {
- #[cfg(unix)]
- if std::env::var("GARAGE_ALLOW_WORLD_READABLE_SECRETS").as_deref() != Ok("true") {
- use std::os::unix::fs::MetadataExt;
- let metadata = std::fs::metadata(file_path)?;
- if metadata.mode() & 0o077 != 0 {
- return Err(format!("File {} is world-readable! (mode: 0{:o}, expected 0600)\nRefusing to start until this is fixed, or environment variable GARAGE_ALLOW_WORLD_READABLE_SECRETS is set to true.", file_path, metadata.mode()).into());
- }
- }
- let mut file = std::fs::OpenOptions::new().read(true).open(file_path)?;
- let mut secret_buf = String::new();
- file.read_to_string(&mut secret_buf)?;
- // trim_end: allows for use case such as `echo "$(openssl rand -hex 32)" > somefile`.
- // also editors sometimes add a trailing newline
- *secret = Some(String::from(secret_buf.trim_end()));
- }
+ (None, Some(file_path)) => *secret = Some(read_secret_file(file_path)?),
}
Ok(())
}