search

juanfont / headscale

An open source, self-hosted implementation of the Tailscale control server
BSD 3-Clause "New" or "Revised" License
23.74k stars 1.3k forks source link

[Feature] Ability to Read Postgres-Pass from File #2110

Open felixw7k opened 2 months ago

felixw7k commented 2 months ago

Use case

As a system administrator i want to check my headscale-config into a git repository. Having secrets in git is considered bad practice, so any headscale-configuration with postgres.pass set, should not be pushed into a git-repo.

Description

If you want to have your configuration versioned, at the moment you are left with the options "using postgres via socket" or "using sqlite" since the password to your database-server would also be checked in.

Being able to read the postgres-password from a file in the headscale-config let's us treat the configuration as "non-secret".

In Docker this file could be bind-mounted by the admin , in a kubernetes-enviromnent it could be set as a secret; which both would no longer be headscale's concern.

Contribution

How can it be implemented?

In my opinion, treating the postgres-password the same as the oidc-client-secret would be perfect: Equivalent to oidc.client_secret_path i could imagine an option like postgres.pass_path to read the password from a file.

kradalby commented 2 months ago

All the configuration options are also settable via environment variables, e.g. HEADSCALE_DATABASE_POSTGRES_PASS.

I dont disagree that it can also be read by file, but I think that solves the majority of problems.

Please also note that we do not actively support or improve postgres and strongly recommend the use of SQLite.