compose: Use Docker secrets for secret management.

Author: alexmv

compose.yaml

@@ -1,15 +1,31 @@
 ---
+secrets:
+  zulip__postgres_password:
+    ## Note that you need to do a manual `ALTER ROLE` query if you
+    ## change this on a system after booting the postgres container
+    ## the first time on a host.  Instructions are available in README.md.
+    environment: "ZULIP__POSTGRES_PASSWORD"
+  zulip__memcached_password:
+    environment: "ZULIP__MEMCACHED_PASSWORD"
+  zulip__rabbitmq_password:
+    environment: "ZULIP__RABBITMQ_PASSWORD"
+  zulip__redis_password:
+    environment: "ZULIP__REDIS_PASSWORD"
+  zulip__secret_key:
+    environment: "ZULIP__SECRET_KEY"
+  zulip__email_password:
+    environment: "ZULIP__EMAIL_PASSWORD"
+
 services:
   database:
     image: "zulip/zulip-postgresql:14"
     restart: unless-stopped
+    secrets:
+      - zulip__postgres_password
     environment:
       POSTGRES_DB: "zulip"
       POSTGRES_USER: "zulip"
-      ## Note that you need to do a manual `ALTER ROLE` query if you
-      ## change this on a system after booting the postgres container
-      ## the first time on a host.  Instructions are available in README.md.
-      POSTGRES_PASSWORD: "REPLACE_WITH_SECURE_POSTGRES_PASSWORD"
+      POSTGRES_PASSWORD_FILE: /run/secrets/zulip__postgres_password
     volumes:
       - "postgresql-14:/var/lib/postgresql/data:rw"
     attach: false
@@ -21,20 +37,32 @@ services:
       - "-euc"
       - |
         echo 'mech_list: plain' > "$$SASL_CONF_PATH"
-        echo "zulip@$$HOSTNAME:$$MEMCACHED_PASSWORD" > "$$MEMCACHED_SASL_PWDB"
-        echo "zulip@localhost:$$MEMCACHED_PASSWORD" >> "$$MEMCACHED_SASL_PWDB"
+        echo "zulip@$$HOSTNAME:$$(cat $$MEMCACHED_PASSWORD_FILE)" > "$$MEMCACHED_SASL_PWDB"
+        echo "zulip@localhost:$$(cat $$MEMCACHED_PASSWORD_FILE)" >> "$$MEMCACHED_SASL_PWDB"
         exec memcached -S
+    secrets:
+      - zulip__memcached_password
     environment:
       SASL_CONF_PATH: "/home/memcache/memcached.conf"
       MEMCACHED_SASL_PWDB: "/home/memcache/memcached-sasl-db"
-      MEMCACHED_PASSWORD: "REPLACE_WITH_SECURE_MEMCACHED_PASSWORD"
+      MEMCACHED_PASSWORD_FILE: /run/secrets/zulip__memcached_password
     attach: false
   rabbitmq:
     image: "rabbitmq:4.1"
     restart: unless-stopped
+    command:
+      - "sh"
+      - "-euc"
+      - |
+        export RABBITMQ_DEFAULT_PASS="$$(cat $$RABBITMQ_PASSWORD_FILE)"
+        echo 'default_user = $$(RABBITMQ_DEFAULT_USER)' >> /etc/rabbitmq/rabbitmq.conf
+        echo 'default_pass = $$(RABBITMQ_DEFAULT_PASS)' >> /etc/rabbitmq/rabbitmq.conf
+        exec docker-entrypoint.sh rabbitmq-server
+    secrets:
+      - zulip__rabbitmq_password
     environment:
       RABBITMQ_DEFAULT_USER: "zulip"
-      RABBITMQ_DEFAULT_PASS: "REPLACE_WITH_SECURE_RABBITMQ_PASSWORD"
+      RABBITMQ_PASSWORD_FILE: /run/secrets/zulip__rabbitmq_password
     volumes:
       - "rabbitmq:/var/lib/rabbitmq:rw"
     attach: false
@@ -44,11 +72,11 @@ services:
     command:
       - "sh"
       - "-euc"
-      - |
-        echo "requirepass '$$REDIS_PASSWORD'" > /etc/redis.conf
-        exec redis-server /etc/redis.conf
+      - '/usr/local/bin/docker-entrypoint.sh --requirepass "$$(cat $$REDIS_PASSWORD_FILE)"'
+    secrets:
+      - zulip__redis_password
     environment:
-      REDIS_PASSWORD: "REPLACE_WITH_SECURE_REDIS_PASSWORD"
+      REDIS_PASSWORD_FILE: /run/secrets/zulip__redis_password
     volumes:
       - "redis:/data:rw"
     attach: false
@@ -74,6 +102,13 @@ services:
         target: 443
         published: 443
         app_protocol: https
+    secrets:
+      - zulip__postgres_password
+      - zulip__memcached_password
+      - zulip__rabbitmq_password
+      - zulip__redis_password
+      - zulip__secret_key
+      - zulip__email_password
     environment:
       ## See https://github.com/zulip/docker-zulip#configuration for
       ## details on this section and how to discover the many
@@ -85,14 +120,12 @@ services:
       SETTING_MEMCACHED_LOCATION: "memcached:11211"
       SETTING_RABBITMQ_HOST: "rabbitmq"
       SETTING_REDIS_HOST: "redis"
-      SECRETS_email_password: "123456789"
-      ## These should match RABBITMQ_DEFAULT_PASS, POSTGRES_PASSWORD,
-      ## MEMCACHED_PASSWORD, and REDIS_PASSWORD above.
-      SECRETS_rabbitmq_password: "REPLACE_WITH_SECURE_RABBITMQ_PASSWORD"
-      SECRETS_postgres_password: "REPLACE_WITH_SECURE_POSTGRES_PASSWORD"
-      SECRETS_memcached_password: "REPLACE_WITH_SECURE_MEMCACHED_PASSWORD"
-      SECRETS_redis_password: "REPLACE_WITH_SECURE_REDIS_PASSWORD"
-      SECRETS_secret_key: "REPLACE_WITH_SECURE_SECRET_KEY"
+      SECRETS_postgres_password_FILE: /run/secrets/zulip__postgres_password
+      SECRETS_memcached_password_FILE: /run/secrets/zulip__memcached_password
+      SECRETS_rabbitmq_password_FILE: /run/secrets/zulip__rabbitmq_password
+      SECRETS_redis_password_FILE: /run/secrets/zulip__redis_password
+      SECRETS_secret_key_FILE: /run/secrets/zulip__secret_key
+      SECRETS_email_password_FILE: /run/secrets/zulip__email_password
       SETTING_EXTERNAL_HOST: "localhost.localdomain"
       SETTING_ZULIP_ADMINISTRATOR: "admin@example.com"
       SETTING_EMAIL_HOST: "" # e.g. smtp.example.com

entrypoint.sh

@@ -286,6 +286,7 @@ secretsConfiguration() {
             echo "ERROR: Secret \"$SECRET_KEY\" contains a newline!"
             exit 1
         fi
+        echo "Setting $SECRET_KEY from environment variable $key"
         crudini --set "$DATA_DIR/zulip-secrets.conf" "secrets" "${SECRET_KEY}" "${SECRET_VAR}"
     done
     echo "Zulip secrets configuration succeeded."