mirrors/prosody
1
0
Fork 0
mirror of https://github.com/bjc/prosody.git synced 2025-04-03 21:27:38 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

core.configmanager: Add function for getting secrets from separate files

Browse source 
Idea is to enable easily retrieving of secret values from files outside
of the config, e.g. via the method used by systemd credentials.

CREDENTIALS_DIRECTORY is expected to be set by the process manager
invoking Prosody, so being unset and unavailable from prosodyctl is
going to be normal and a warning is reported in that case. Care will
have to be taken to make it clear that prosodyctl check will not work
with such values. An error is thrown if the directory is unavailable
when running under Prosody.
This commit is contained in:
Kim Alvefur 2025-01-16 15:21:34 +01:00
parent 2f37c443b8
commit 41a360ce2a
3 changed files with 22 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
CHANGES
View file

@ -60,7 +60,7 @@ TRUNK
- The configuration file now supports referring and appending to options previously set
- Direct usage of the Lua API in the config file is deprecated, but can now be accessed via Lua.* instead
- Convenience functions for reading values from files
- Convenience functions for reading values from files, with variant meant for credentials or secrets
## Changes

14
core/configmanager.lua
View file

@ -198,6 +198,7 @@ do
FileContents = true,
FileLine = true,
FileLines = true,
Secret = true,
Include = true, include = true, RunScript = true }, {
__index = function (_, k)
if k:match("^ENV_") then
@ -359,6 +360,19 @@ do
env.FileLine = filereader(config_path, "*l");
env.FileLines = linereader(config_path);
if _G.prosody.paths.secrets then
env.Secret = filereader(_G.prosody.paths.secrets, "*a");
elseif _G.prosody.process_type == "prosody" then
env.Secret = function() error("Secret() requires the $CREDENTIALS_DIRECTORY environment variable to be set", 2) end
else
env.Secret = function()
t_insert(warnings, ("%s:%d: Secret() requires the $CREDENTIALS_DIRECTORY environment variable to be set")
:format(config_file, get_line_number(config_file)));
return nil;
end
end
local chunk, err = envload(data, "@"..config_file, env);
if not chunk then

9
util/startup.lua
View file

@ -266,8 +266,13 @@ function startup.init_global_state()
full_sessions = prosody.full_sessions;
hosts = prosody.hosts;
prosody.paths = { source = CFG_SOURCEDIR, config = CFG_CONFIGDIR or ".",
plugins = CFG_PLUGINDIR or "plugins", data = "data" };
prosody.paths = {
source = CFG_SOURCEDIR;
config = CFG_CONFIGDIR or ".";
plugins = CFG_PLUGINDIR or "plugins";
data = "data";
secrets = os.getenv("CREDENTIALS_DIRECTORY");
};
prosody.arg = _G.arg;