Description
Hi there,
I plan to use Gitea in a production environment on a Docker Swarm cluster. I want to avoid having clear-text passwords in my docker-compose file.
An easy way to protect credentials with Docker Swarm is to use secrets. See https://docs.docker.com/engine/swarm/secrets/
Docker secrets are mounted as files in the container, so I can't use the environment variable DB_PASSWD
.
A workaround used by images like MySQL or Postgres is to provide an environment variable storing the path of the secret, e.g. DB_PASSWD_FILE
, then read that file. See section "Docker Secrets" on https://hub.docker.com/_/mysql for an example.
It would be nice to have the same for Gitea. This would only require an additional step during Gitea s6 setup
, before setting default configuration variables.
if [ -n "$DB_PASSWD_FILE" ] && [ -r "$DB_PASSWD_FILE" ]; then
DB_PASSWD=$(cat $DB_PASSWD_FILE)
fi
Here is a minimal docker-compose example where I used a custom image to add the above step.
version: '3.7'
services:
git:
image: custom-gitea
environment:
DB_TYPE: mysql
DB_HOST: db:3306
DB_NAME: gitea
DB_USER: root
DB_PASSWD_FILE: /run/secrets/db-password
ROOT_URL: git:3000
SSH_DOMAIN: git
SSH_PORT: 22
ports:
- 3003:3000
networks:
- default
secrets:
- source: db-password
target: /run/secrets/db-password
mode: 0400
db:
image: mysql:5.7
environment:
MYSQL_ROOT_PASSWORD_FILE: /run/secrets/db-password
MYSQL_DATABASE: gitea
networks:
- default
secrets:
- source: db-password
target: /run/secrets/db-password
mode: 0400
networks:
default:
driver: overlay
secrets:
db-password:
file: './db-password'
Steps :
# On a Docker Swarm cluster
echo 'mydatabasepassword' > db-password
docker stack deploy -c docker-compose.yml gitea-test
- Gitea version (or commit ref): 1.10
- Operating system: Docker
- Database (use
[x]
):- PostgreSQL
- MySQL
- MSSQL