Add support for Docker Secrets by reading secrets files

[horatiohe]

Version Information

Server Version:
CLI Version (for CLI related issue):

Environment

EE

What is the current behaviour?

hasura ee container ONLY take configuration properties from environment variables

What is the expected behaviour?

expect to load hasura configuration properties, especially hasura_adminm_secret from file instread of ONLY from environment variables in container setup

How to reproduce the issue?

Screenshots or Screencast

Please provide any traces or logs that could help here.

Any possible solutions?

Can you identify the location in the source code where the problem exists?

If the bug is confirmed, would you be willing to submit a PR?

Keywords

[adas98012]

You can pass the env vars from a file (and specify the file in the docker compose).

Here is a sample docker compose file (see highlighted env_file section):

`
docker-compose.yml

version: '3.6'
services:
postgres:
image: postgres:12
restart: always
volumes:
- db_data:/var/lib/postgresql/data
environment:
POSTGRES_PASSWORD: postgrespassword
graphql-engine:
image: hasura/graphql-engine:v2.11.0
ports:
- "8080:8080"
depends_on:
- "postgres"
restart: always
env_file:
- ./test_env_vars.test
volumes:
db_data:

`
You can then add all your env vars in test_env_vars.test (used for illustration, please use a name suitable for your use):

`
test_env_vars.test
environment:
## postgres database to store Hasura metadata
HASURA_GRAPHQL_METADATA_DATABASE_URL: postgres://postgres:postgrespassword@postgres:5432/postgres
## this env var can be used to add the above postgres database to Hasura as a data source. this can be removed/updated based on your needs
PG_DATABASE_URL: postgres://postgres:postgrespassword@postgres:5432/postgres
## enable the console served by server
HASURA_GRAPHQL_ENABLE_CONSOLE: "true" # set to "false" to disable console
## enable debugging mode. It is recommended to disable this in production
HASURA_GRAPHQL_DEV_MODE: "true"
HASURA_GRAPHQL_ENABLED_LOG_TYPES: startup, http-log, webhook-log, websocket-log, query-log
## uncomment next line to set an admin secret
HASURA_GRAPHQL_ADMIN_SECRET: 1234

`

Let us know if this answers your question.

[horatiohe]

hi mate, we are using eks deployment, don't have docker-compose to start the service :(

[inta]

Despite not everyone is using compose, an environment variable is not a secret and the security level is not even close. This should not be a discussion, this should be an issue and the selected answer is not an answer to the question. If you do not want to implement it, fine, just say that. ENV is not equivalent to Docker secrets.