Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support for storing credentials in environment variables #207

Open
SchoolGuy opened this issue Sep 27, 2024 · 3 comments
Open

Support for storing credentials in environment variables #207

SchoolGuy opened this issue Sep 27, 2024 · 3 comments

Comments

@SchoolGuy
Copy link

As a user
I want to avoid storing sensitive data in configuration files
so that I can easily store the configuration files inside of version control systems.


Now a bit more details of what my issue is: I am using the provided Docker Hub image and am using docker-compose to start my monitoring stack. The configuration data as well as the compose file is currently under version control in Git. This opens up the issue of passwords needing to be written in plain text and stored in Git.

My idea to solve this would be to load the username and password from environment variables with the following schema:

IPMIEXPORTER_MODULES_<name>_USER="user"
IPMIEXPORTER_MODULES_<name>_PASS="pass"

I that this is what #155 was about in the end.

@SchoolGuy
Copy link
Author

If the maintainers accept this feature request I am able to contribute this feature as I have a dedicated time budget at work to do these kinds of contributions.

@SuperQ
Copy link
Contributor

SuperQ commented Sep 28, 2024

Configuration files are more safe than env vars. I recommend against doing this.

@SchoolGuy
Copy link
Author

SchoolGuy commented Sep 28, 2024

@SuperQ If the source of truth is a Git repository then credential leakage is much more likely if you have the full configuration file stored inside Git. If the credentials are stored separately to the configuration file the likelihood is much lesser. Encrypting full configuration files is a practice I have never heard of.

Since the behavior I am desiring is opt-in I don't see why one should give a recommendation against this new functionality. Even more, it has been standard practice to configure daemons via environment variables since the dawn of time (notably /etc/sysconfig as the most famous option).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants