Using secrets file?

[trexxeon]

Shlink version

v3.6.3

PHP version

latest

How do you serve Shlink

RoadRunner Docker image

Database engine

MariaDB

Database version

10.8.8

Summary

I have a running setup of shlink, but I want to change my compose file to using secrets files, so I tried to set them in the compose:

version: "3.8"

secrets:
    DB_PASSWORD:
      file: /shlink/secrets/DB_PASSWORD
    MARIADB_PASSWORD:
      file: /shlink/secrets/MARIADB_PASSWORD
    MARIADB_ROOT_PASSWORD:
      file: /shlink/secrets/MARIADB_ROOT_PASSWORD
services:
  shlink:
    image: shlinkio/shlink:stable
    restart: always
    secrets: [MARIADB_PASSWORD, MARIADB_ROOT_PASSWORD, DB_PASSWORD]
    environment:
      TZ: "Europe/Stockholm"
      DEFAULT_DOMAIN: hidden_for_git
      BASE_PATH: /
      DEFAULT_BASE_URL_REDIRECT: https://hidden_for_git/
      DEFAULT_REGULAR_404_REDIRECT: https://hidden_for_git/
      DEFAULT_INVALID_SHORT_URL_REDIRECT: https:/hidden_for_git/
      IS_HTTPS_ENABLED: true
      GEOLITE_LICENSE_KEY: 
      DB_DRIVER: maria
      DB_USER: shlink
      DB_NAME: shlink
      DB_PASSWORD_FILE: /run/secrets/DB_PASSWORD
      DB_HOST: database
    depends_on:
      - database
    ports:
      - 172.17.0.1:8383:8080

  database:
    image: mariadb:10.8
    restart: always
    secrets: [MARIADB_PASSWORD, MARIADB_ROOT_PASSWORD, DB_PASSWORD]
    environment:
       UID: 1000
       GID: 1000
       MARIADB_ROOT_PASSWORD_FILE: /run/secrets/MARIADB_ROOT_PASSWORD
       MARIADB_DATABASE: shlink
       MARIADB_USER: shlink
       MARIADB_PASSWORD_FILE: /run/secrets/MARIADB_PASSWORD
    volumes:
      - /shlink/db_data:/var/lib/mysql

But when I start everything up it says that it's trying to access the database without a password and fails, it's like the password isn't being read. The same method have worked for other compose projects, so what's failing here?

[acelaya]

Try this change:

- DB_PASSWORD_FILE: /run/secrets/DB_PASSWORD
+ DB_PASSWORD: /run/secrets/DB_PASSWORD

[acelaya]

Nah, that won't work.

As you can notice here https://docs.docker.com/compose/use-secrets/, the _FILE suffix is a convention that some images use, but not something that works out of the box.

In the case of Shlink, it does not work like this. Feel free to open a feature request and I'll take a look at some way to provide secrets as files.

[trexxeon]

Thank you for your answe, I have now created a feature request :)

[acelaya]

As of Shlink 4.0.0, which was released yesterday, this is now supported.

See https://shlink.io/documentation/environment-variables/#secret-env-vars for details.