Added support for docker secrets

[DennisGaida]

Right now the bouncer API key needs to be hardcoded in the compose file and/or in the external .env. The current best practice is to leverage docker secrets that are not only supported in swarm mode, but also from docker compose.

I have added a basic implementation within the RequiredEnv function, that allows the use of <environment_variable_name>+_FILE instead of <environment_variable_name>. So CROWDSEC_BOUNCER_API_KEY becomes CROWDSEC_BOUNCER_API_KEY_FILE. If said [...]_FILE variable exists the value is read from the file and returned from the RequiredEnv function.

I'd greatly appreciate some testing since logging from config.go seems kind of impossible? Even the existing log.Fatalf() entries I never get to see in the docker logs (though the container doesn't start).

Example docker-compose:

version: "3.8"

secrets:
  crowdsec_bouncer_api_key:
    file: /secretsPath/crowdsec_bouncer_api_key

services:
  bouncer:
    build: .
    image: fbonalair/traefik-crowdsec-bouncer
    container_name: bouncer
    environment:
      CROWDSEC_BOUNCER_API_KEY_FILE: /run/secrets/crowdsec_bouncer_api_key
      CROWDSEC_AGENT_HOST: crowdsec:8123
    secrets:
      - crowdsec_bouncer_api_key

[fbonalair]

Thank you for your contribution, that's a great idea.
My design of the app is not the best, so testing is not as easy as I would like ...
I have put some feedback to your change. Once they are fine I will merge it and add comments in the README.

[fbonalair]

Instead of adding a "_FILE" suffix, then you have a value, could you detect if the environment value is a valid file path ? For example with the function os.Stat(path).
Like that, you have one less nest in the if statement, so it's more streamlined while still being able to get different logs for direct value vs file value.

[DennisGaida]

I could do that and you are the maintainer.

I use a lot of containers and the de facto standard is to use different named environment variables for your secrets. Linuxserver.io (which provide a loooot of container) use the FILE__<env-var> nomenclature (see e.g. https://hub.docker.com/r/linuxserver/mariadb) for their s6-overlay. Many other containers I know use the <env-var>_FILE nomenclature.

I'm not very opinionated and can also go with the os.Stat(path) if you tell me to do so.

[fbonalair]

First, nice error message ! That would help the user.
Second, to go further, also send the "root" error back to the user. That would make debugging easier : was it a miss-configuration and file is not present? Or app can't read the file because of permission ? etc etc

[DennisGaida]

Also outputting the original error in DennisGaida@fba0274

Please note that ReadFile doesn't guarantee any specific behavior besides no-error == nil. I hope that using %v is the right thing to do, but seeing other error checking code, usually specific errors are caught, like "file not found" or "path invalid".

[qlty-cloud-legacy]

Code Climate has analyzed commit fba0274 and detected 0 issues on this pull request.

View more on Code Climate.

[johnweland]

Looks like I wasn't the only one with this idea. The bouncer is a great piece of code, hopefully it can get updated with this feature