WeBWorK Main Forum

How to keep credentials out of git when using Docker/Docker Compose?

How to keep credentials out of git when using Docker/Docker Compose?

by David Reagan -
Number of replies: 2
Hey all,

While setting up my Webwork project based on docker and docker-compose, I've hit the point where I'm wondering how to keep my database and ldap credentials out of git.

For other apps, I've been able to use Docker secrets via docker-compose files. That lets me just write secrets to text files that are ignored by git, and docker then mounts those files under /run/secrets/. Then the app just has to read the /run/secrets/ files.

In Drupal, I just use file_get_contents() to load the info into the settings file. Is there a PERL equivalent that would run in the conf files?

Any other ideas?
In reply to David Reagan

Re: How to keep credentials out of git when using Docker/Docker Compose?

by Nathan Wallach -
I don't think there is any trivial method to have the config files read external files and modify themselves.

I use a different approach to keep my "local" config outside the tree under Git control:

I keep a locally modified version of docker-compose.yml and several other things outside of the main webwork2 tree. The docker-compose.yml file "bind mounts" several locally modified config files from outside the directories controlled by Git. Here are some example lines from docker-compose.yml:

# webwork2 LOCAL config - mount live (per host) so NOT in the main webwork2 location
- "/nfs/webwork2_local_config/webwork2/conf/authen_LTI.conf:/opt/webwork/webwork2/conf/authen_LTI.conf"
- "/nfs/webwork2_local_config/webwork2/conf/localOverrides.conf:/opt/webwork/webwork2/conf/localOverrides.conf"
- "/nfs/webwork2_local_config/webwork2/conf/site.conf:/opt/webwork/webwork2/conf/site.conf"


I have the SQL passwords set in the relocated docker-compose.yml file, and it uses a special block to refer to where the "main" webwork2 tree is, as well as to where a locally modified version of the Dockerfile is:

app:
build:
context: /nfs/webwork_shared_2019_07/webwork2/
dockerfile: /nfs/webwork_shared_2019_07/LOCAL-FILES-USED-2019-07-15-ubuntu-1804/Dockerfile

You can also set environment variables via docker-compose.yml and then docker-entrypoint.sh can modify config files at startup time.

The WW 2.15 tree has Docker control files which have many examples and comments about things related to this approach.
In reply to Nathan Wallach

Re: How to keep credentials out of git when using Docker/Docker Compose?

by David Reagan -
Keeping docker-compose.yml and those config files out of git was the workaround I was planning on.

Can't say it's my favorite thing in the world, but it'll have to do.

Thanks for the response. :)