From ccf3a9f3b20ec1cb1a1c5492aac6a729ceb1054d Mon Sep 17 00:00:00 2001
From: Trenton Holmes <trenton.holmes@psware.com>
Date: Tue, 24 May 2022 13:15:01 -0700
Subject: [PATCH] Implements reading from a Docker secrets file in place of an
environment variable for certain settings
---
docker/docker-entrypoint.sh | 46 +++++++++++++++++++++++++++++++++++++
docs/setup.rst | 13 +++++++++++
2 files changed, 59 insertions(+)
diff --git a/docker/docker-entrypoint.sh b/docker/docker-entrypoint.sh
index d4b0d8c58..c1e7588e1 100755
--- a/docker/docker-entrypoint.sh
+++ b/docker/docker-entrypoint.sh
@@ -2,6 +2,37 @@
set -e
+# Adapted from:
+# https://github.com/docker-library/postgres/blob/master/docker-entrypoint.sh
+# usage: file_env VAR
+# ie: file_env 'XYZ_DB_PASSWORD' will allow for "$XYZ_DB_PASSWORD_FILE" to
+# fill in the value of "$XYZ_DB_PASSWORD" from a file, especially for Docker's
+# secrets feature
+file_env() {
+ local var="$1"
+ local fileVar="${var}_FILE"
+
+ # Basic validation
+ if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
+ echo >&2 "error: both $var and $fileVar are set (but are exclusive)"
+ exit 1
+ fi
+
+ # Only export var if the _FILE exists
+ if [ "${!fileVar:-}" ]; then
+ # And the file exists
+ if [[ -f ${!fileVar} ]]; then
+ echo "Setting ${var} from file"
+ val="$(< "${!fileVar}")"
+ export "$var"="$val"
+ else
+ echo "File ${!fileVar} doesn't exist"
+ exit 1
+ fi
+ fi
+
+}
+
# Source: https://github.com/sameersbn/docker-gitlab/
map_uidgid() {
USERMAP_ORIG_UID=$(id -u paperless)
@@ -22,6 +53,21 @@ map_folders() {
}
initialize() {
+
+ # Setup environment from secrets before anything else
+ for env_var in \
+ PAPERLESS_DBUSER \
+ PAPERLESS_DBPASS \
+ PAPERLESS_SECRET_KEY \
+ PAPERLESS_AUTO_LOGIN_USERNAME \
+ PAPERLESS_ADMIN_USER \
+ PAPERLESS_ADMIN_MAIL \
+ PAPERLESS_ADMIN_PASSWORD; do
+ # Check for a version of this var with _FILE appended
+ # and convert the contents to the env var value
+ file_env ${env_var}
+ done
+
# Change the user and group IDs if needed
map_uidgid
diff --git a/docs/setup.rst b/docs/setup.rst
index b8d3ab8a3..2eee43fec 100644
--- a/docs/setup.rst
+++ b/docs/setup.rst
@@ -200,6 +200,19 @@ Install Paperless from Docker Hub
You can copy any setting from the file ``paperless.conf.example`` and paste it here.
Have a look at :ref:`configuration` to see what's available.
+ .. note::
+
+ You can utilize Docker secrets for some configuration settings by
+ appending `_FILE` to some configuration values. This is supported currently
+ only by:
+ * PAPERLESS_DBUSER
+ * PAPERLESS_DBPASS
+ * PAPERLESS_SECRET_KEY
+ * PAPERLESS_AUTO_LOGIN_USERNAME
+ * PAPERLESS_ADMIN_USER
+ * PAPERLESS_ADMIN_MAIL
+ * PAPERLESS_ADMIN_PASSWORD
+
.. caution::
Some file systems such as NFS network shares don't support file system