screepers / screeps-launcher

Launcher for the Screeps Private Server
MIT License
133 stars 34 forks source link

[feature] Support docker / docker-compose secrets for steamKey #13

Closed katanacrimson closed 3 years ago

katanacrimson commented 4 years ago

I'm a big fan of isolating secrets away from configuration. Making secrets available in docker-compose (without running docker in swarm mode) is fairly easy, and supporting that feature should be straightforward enough.

Proposal: If steamKeyFile is specified instead of steamKey, then the exact contents of the file specified in steamKeyFile should be used.

To use this in docker-compose afterwards, the compose file would need to specify a new secret like so:

version: '3'
services:
  screeps:
    image: screepers/screeps-launcher
    volumes:
      - ./config.yml:/screeps/config.yml
      - screeps-data:/screeps
    ports:
      - 21025:21025/tcp
    environment:
      MONGO_HOST: mongo
      REDIS_HOST: redis
    restart: unless-stopped
    secrets:
      - screeps_steam_key

  mongo:
    image: mongo
    volumes:
      - mongo-data:/data/db
    restart: unless-stopped

  redis:
    image: redis
    volumes:
      - redis-data:/data
    restart: unless-stopped

volumes:
  redis-data:
  mongo-data:
  screeps-data:

secrets:
  screeps_steam_key:
    file: ./screeps_steam_key

Pros:

Cons:


Unfortunately, I'm not familiar enough with Go, otherwise I'd throw a PR down instead of an issue.

AlinaNova21 commented 4 years ago

It shouldn't be too hard to implement, if steamKeyFile is specified, set steamKey to the contents, As an aside, you can currently pass in the environment variable STEAM_KEY to avoid it in the config. (I do this for S+ in kubernetes, STEAM_KEY and a few others like MAPTOOL_PASS are in a secret that is mounted as environment variables, while the config.yml is in a configmap)