FeatureFuel
1

feat: allow sensitive environment variables to be the path to a file that contains the value

Source: dani-garcia/vaultwarden#2759 · opened by @aentwist
In Docker, environment variables are not truly secure as they exist in images and are not masked. The only truly secure method to incorporate secrets is by mounting files containing them through to containers. Docker Swarm, and now Compose, implement this with [secrets]( Some applications allow configuration to be specified as the path to a file containing a value instead of the value directly for this kind of reason. I would like this to be possible with Vaultwarden, particularly regarding the admin token and SMTP credentials. This would be implemented with a new set of configuration environment variables to avoid dual-purposing existing ones, breaking changes, etc. New environment variables would have the same names as their direct-valued counterparts, besides the addition of a meaningful suffix, likely _PATH or _FILE. For example, [GitGuardian]( seems to mark SMTP host, port, username, and password as sensitive. Thus, these four configuration environment variables a…

No pledges yet. Be the first to back this.

Make a pledge

Pledge your monetary support if this feature is added.

$

Comments

No comments yet.

Replying to

Add a comment

What do you think about this feature request?


Similar requests