hasura / hasura/graphql-engine

Add support for Docker Secrets by reading secrets files

Open
#3,989 19 comments 27 reactions 1 assignee Claimed by @tirumaraiselvan View on GitHub
a/security c/server help wanted k/enhancement
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

Currently, the only way to pass secrets (DB credentials, Hasura admin secret) to Hasura is only by environment variables. For users of Docker Compose or Docker Swarm, this means these secrets have to be stored in plaintext, which presents security risks.

It would be great to build support for Docker Secrets (or even Vault), by adding the following environment variables, as recommended by Docker:

* HASURA_GRAPHQL_ACCESS_KEY_FILE
* HASURA_GRAPHQL_DATABASE_URL_FILE

If these variables are present, the access key and DB URL should be read from the corresponding files.

Docs: https://docs.docker.com/engine/swarm/secrets/#build-support-for-docker-secrets-into-your-images

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.