Mercurial > prosody-hg

comparison core/configmanager.lua @ 13627:2db7b3b65363

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
core.configmanager: Add function for getting secrets from separate files Idea is to enable easily retrieving of secret values from files outside of the config, e.g. via the method used by systemd credentials. CREDENTIALS_DIRECTORY is expected to be set by the process manager invoking Prosody, so being unset and unavailable from prosodyctl is going to be normal and a warning is reported in that case. Care will have to be taken to make it clear that prosodyctl check will not work with such values. An error is thrown if the directory is unavailable when running under Prosody.
author Kim Alvefur <zash@zash.se>
date Thu, 16 Jan 2025 15:21:34 +0100
parents ac60c21015c7
children 4fdd406564ea
comparison
equal deleted inserted replaced
13626:ac60c21015c7 13627:2db7b3b65363
196 Host = true, host = true, VirtualHost = true, 196 Host = true, host = true, VirtualHost = true,
197 Component = true, component = true, 197 Component = true, component = true,
198 FileContents = true, 198 FileContents = true,
199 FileLine = true, 199 FileLine = true,
200 FileLines = true, 200 FileLines = true,
201 Secret = true,
201 Include = true, include = true, RunScript = true }, { 202 Include = true, include = true, RunScript = true }, {
202 __index = function (_, k) 203 __index = function (_, k)
203 if k:match("^ENV_") then 204 if k:match("^ENV_") then
204 return os.getenv(k:sub(5)); 205 return os.getenv(k:sub(5));
205 end 206 end
357 358
358 env.FileContents = filereader(config_path, "*a"); 359 env.FileContents = filereader(config_path, "*a");
359 env.FileLine = filereader(config_path, "*l"); 360 env.FileLine = filereader(config_path, "*l");
360 env.FileLines = linereader(config_path); 361 env.FileLines = linereader(config_path);
361 362
363 if _G.prosody.paths.secrets then
364 env.Secret = filereader(_G.prosody.paths.secrets, "*a");
365 elseif _G.prosody.process_type == "prosody" then
366 env.Secret = function() error("Secret() requires the $CREDENTIALS_DIRECTORY environment variable to be set", 2) end
367 else
368 env.Secret = function()
369 t_insert(warnings, ("%s:%d: Secret() requires the $CREDENTIALS_DIRECTORY environment variable to be set")
370 :format(config_file, get_line_number(config_file)));
371 return nil;
372 end
373
374 end
375
362 local chunk, err = envload(data, "@"..config_file, env); 376 local chunk, err = envload(data, "@"..config_file, env);
363 377
364 if not chunk then 378 if not chunk then
365 return nil, err; 379 return nil, err;
366 end 380 end