tshakah/attic
0
0
Fork 0
forked from nrabulinski/attic
Code Pull requests Activity

server/config: Support loading HS256 JWT secret from environment variable

Browse source
This commit is contained in:
Zhaofeng Li 2023-01-06 00:59:35 -07:00
parent 82fb6682d7
commit b0471c6804
2 changed files with 20 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
server/src/config-template.toml
View file

@ -37,6 +37,8 @@ allowed-hosts = []
# JWT signing token # JWT signing token
# #
# Set this to the Base64 encoding of some random data. # Set this to the Base64 encoding of some random data.
# You can also set it via the `ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64` environment
# variable.
token-hs256-secret-base64 = "%token_hs256_secret_base64%" token-hs256-secret-base64 = "%token_hs256_secret_base64%"
# Database connection # Database connection

18
server/src/config.rs
View file

@ -25,6 +25,9 @@ const XDG_PREFIX: &str = "attic";
/// This is useful for deploying to certain application platforms like Fly.io /// This is useful for deploying to certain application platforms like Fly.io
const ENV_CONFIG_BASE64: &str = "ATTIC_SERVER_CONFIG_BASE64"; const ENV_CONFIG_BASE64: &str = "ATTIC_SERVER_CONFIG_BASE64";
/// Environment variable storing the Base64-encoded HS256 JWT secret.
const ENV_TOKEN_HS256_SECRET_BASE64: &str = "ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64";
#[derive(Clone)] #[derive(Clone)]
pub struct JwtKeys { pub struct JwtKeys {
pub decoding: JwtDecodingKey, pub decoding: JwtDecodingKey,
@ -100,6 +103,7 @@ pub struct Config {
/// Set this to the base64 encoding of a randomly generated secret. /// Set this to the base64 encoding of a randomly generated secret.
#[serde(rename = "token-hs256-secret-base64")] #[serde(rename = "token-hs256-secret-base64")]
#[serde(deserialize_with = "deserialize_base64_jwt_secret")] #[serde(deserialize_with = "deserialize_base64_jwt_secret")]
#[serde(default = "JwtKeys::load_from_env")]
#[derivative(Debug = "ignore")] #[derivative(Debug = "ignore")]
pub token_hs256_secret: JwtKeys, pub token_hs256_secret: JwtKeys,
} }
@ -185,6 +189,20 @@ pub struct GarbageCollectionConfig {
pub default_retention_period: Duration, pub default_retention_period: Duration,
} }
impl JwtKeys {
fn load_from_env() -> Self {
let s = env::var(ENV_TOKEN_HS256_SECRET_BASE64)
.expect("The HS256 secret must be specified in either token_hs256_secret or the ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64 environment.");
let decoding = JwtDecodingKey::from_base64_secret(&s)
.expect("Failed to load as decoding key");
let encoding = JwtEncodingKey::from_base64_secret(&s)
.expect("Failed to load as decoding key");
Self { decoding, encoding }
}
}
impl CompressionConfig { impl CompressionConfig {
pub fn level(&self) -> CompressionLevel { pub fn level(&self) -> CompressionLevel {
if let Some(level) = self.level { if let Some(level) = self.level {