Better security for `password` in the config

[neon64]

I'd like to be able to store my mopidy.conf inside my own dotfiles git repository... However it contains the password to my Google account.. what is the best way to make this more secure?

[kingosticks]

Create an App password (you might need to be using 2-step verification for this, which you should be anyway).

You can also use a keyring as helpfully described at https://github.com/mopidy/mopidy-spotify/pull/65#issuecomment-295373011

[neon64]

Yep I'm already using an app password because of two-step verification.. but if i publish that on the internet then anyone will be able to log in, yes?... But that keyring information looks like exactly what i need, thank you!

[kingosticks]

Ha yeh sorry I mistakenly answered the title rather than the actual question!

You can also try putting just the gmusic password setting in it's own config file and get Mopidy to read that too. On Debian/Ubuntu you can stick the file in /usr/share/mopidy/conf.d/ and the service will read that automatically.

[kuzzmi]

@neon64 Have you managed to make it working with keyring? Having issues with this, keyring information is added but not read.

[neon64]

Sorry @kuzzmi, since then I got completely side-tracked and never actually tried to do it.. And from the linked issue I'm can't find out where the 'keyring' file is actually stored so I can add my passwords there

[kuzzmi]

@neon64, I found the solution.

If you run mopidy -vvvv and see an exception 'Fetching passwords from your keyring failed. Any passwords stored in the keyring will not be available. (dbus not installed)', then you need to install python2-dbus and add the following to the keyring (using secret-tool or seahorse):

    [/org/freedesktop/secrets/collection/login/10]
    secret = [ Your password here ]
    attribute.section = spotify
    attribute.service = mopidy
    attribute.key = password
    [/org/freedesktop/secrets/collection/login/11]
    secret = [ Your username here ]
    attribute.section = spotify
    attribute.service = mopidy
    attribute.key = username

After this you can remove your mopidy.spotify.username and mopidy.spotify.password from the config

When mopidy starts, it queries the keyring for all records with service mopidy to get the data from the keyring.

[kschat]

If you don't want to use keyring for whatever reason, but you still want to have your mopidy configuration in source control you can do what I do and have 2 separate configuration files - one with your password, the other with all your other configuration. Then when you start mopidy cat the files and use process substitution to get a file descriptor that you can pass to --config. For example.

If you have a problem with having your password in plaintext on your filesystem then you can always encrypt it and then decrypt it before you call cat. Unfortunately your password will still be in plaintext in memory, but it's better than nothing.

[memeplex]

You can also use pass (https://www.passwordstore.org/) and simply store the configuration section under some key and retrieve it from the command line, it's similar to the cat example.

[belak]

This isn't something that can be fixed in this plugin without support from mopidy, so I'm closing this for now. For more information, please follow the mopidy issue linked above.