Skip to content
Snippets Groups Projects
Unverified Commit a0fde033 authored by Andrej Shadura's avatar Andrej Shadura
Browse files

Copy secrets with correct ownership instead of symlinking them


Secrets are owned by root and are not world-readable by default, so
the frontend cannot access them when it’s not running as root.
Not all versions of docker-compose support setting access rights for
secrets, so instead of wrangling with them, just copy secrets and
re-own them.

Signed-off-by: Andrej Shadura's avatarAndrej Shadura <andrew.shadura@collabora.co.uk>
parent fca80a4d
No related branches found
No related tags found
No related merge requests found
Pipeline #39764 passed
...@@ -15,7 +15,8 @@ done ...@@ -15,7 +15,8 @@ done
# Allow overriding the secret key # Allow overriding the secret key
if [ -f /run/secrets/secretkey ] if [ -f /run/secrets/secretkey ]
then then
ln -sf /run/secrets/secretkey config/secret.key cp /run/secrets/secretkey config/secret.key
chown frontend config/secret.key
fi fi
if [ ! -r config/secret.key ] if [ ! -r config/secret.key ]
...@@ -50,11 +51,13 @@ fi ...@@ -50,11 +51,13 @@ fi
# Set up msmtp if a configuration is supplied # Set up msmtp if a configuration is supplied
if [ -f /run/secrets/msmtprc ] if [ -f /run/secrets/msmtprc ]
then then
ln -sf /run/secrets/msmtprc /etc/msmtprc cp /run/secrets/msmtprc /etc/msmtprc
chown frontend /etc/msmtprc
fi fi
# Set up SSO auth if a configuration is supplied # Set up SSO auth if a configuration is supplied
if [ -f /run/secrets/ssoauth ] if [ -f /run/secrets/ssoauth ]
then then
ln -sf /run/secrets/ssoauth config/auth.yml cp /run/secrets/ssoauth config/auth.yml
chown frontend config/auth.yml
fi fi
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment