pomerium / pomerium

Pomerium is an identity and context-aware access proxy.
https://www.pomerium.com
Apache License 2.0
4.04k stars 284 forks source link

core/config: add databroker_storage_connection_string_file #5228

Closed calebdoxsey closed 1 month ago

calebdoxsey commented 2 months ago

Is your feature request related to a problem? Please describe.

Currently Pomerium accepts databroker_storage_connection_string for the databroker connection string to the database. This often contains usernames and passwords, which are sensitive and shouldn't be stored as plaintext in the YAML config.

Describe the solution you'd like

Like with shared_secret_file and cookie_secret_file it would be nice if Pomerium also accepted databroker_storage_connection_string_file so the DSN would not need to stored in the config file or passed via an environment variable.

Additional context

Previously https://github.com/pomerium/pomerium/pull/3453

calebdoxsey commented 2 months ago

You can now set the databroker_storage_connection_string from a file.

echo '
postgres://postgres@localhost/pomerium?sslmode=disable
' >/tmp/dsn
export DATABROKER_STORAGE_CONNECTION_STRING_FILE='/tmp/dsn'
ssveta7ak commented 1 month ago

Implemented. Checked on pomerium: 0.27.0+dad954ae envoy: 1.31.0+59c34f2ead46e56f647993324faed008a6910f1606ba34d78e77acf5d3ab89c3