5fc136dc49
The password now lives in CADPRox_Secrets (mode 600, git-ignored) and is
mounted read-only into the container, rather than being read from the
compose file. Two reasons:
- the password contains '#', which YAML reads as the start of a comment,
so putting it in docker-compose.yml was never going to work;
- anything in the compose file is visible in `docker compose config` and
`docker inspect`, and would be easy to commit by accident.
read_secrets_file() accepts either a bare password on one line, which is
the common case, or a key=value file so the same file can hold more than
one secret later. A bare password containing '=' is not mangled, because
the key/value parse only wins when it recognises one of its own keys.
Also detect a bind mount whose source is missing. Docker creates a
directory in that case, which would otherwise fail confusingly and
quietly leave the app with no password.
The port stays CADPROX_PORT in the compose file and is deliberately not
added to ports:. Publishing a port needs bridge networking, which cannot
reach Caddy's admin API on 127.0.0.1:2019, and Docker discards a ports:
entry under host mode with only a warning - so it would read as a mapping
that is not there. Documented in the README instead.
16 lines
200 B
Plaintext
16 lines
200 B
Plaintext
# Runtime state, the generated admin credential and the audit log.
|
|
data/
|
|
|
|
# Secrets. Never commit this.
|
|
CADPRox_Secrets
|
|
*.secrets
|
|
|
|
# OS / editor cruft
|
|
.DS_Store
|
|
Thumbs.db
|
|
*.swp
|
|
*~
|
|
|
|
__pycache__/
|
|
*.pyc
|