Allow setting certificates/key pairs via environment variables

[stevenbal]

Suggestion from gemeente Amsterdam:

Could it be possible to store certificates/private keys for mutual TLS using environment variables (as an extra option, instead of uploading them via the admin interface) and referring to those environment variables in the Certificate model? This removes the need to have (persistent) volumes to keep uploaded certificates in storage after redeploys.

@sergei-maertens thoughts?

[sergei-maertens]

I'd suggest creating a fixture instead with the paths to the certificates, and then mounting the certificates as ConfigMap/Secret in a subfolder of the private-media storage. That way you still have the database records, they point to actual mounted files and no code changes are needed.

At the deployment level, you can set up an init container to ensure the fixture is loaded (and migrations are run).

[joeribekker]

I'm open to integration with keystores and the likes.

This library was created for self-service changing certificates, instead of having environment variables :)