Default to a secret file

This commit is contained in:
Neale Pickett 2023-02-18 12:47:05 -07:00
parent 969c3797af
commit e013bb6a9a
6 changed files with 11 additions and 39 deletions

View File

@ -57,6 +57,7 @@ services:
image: ghcr.io/nealey/simpleauth
secrets:
- password
- simpleauth.key
deploy:
labels:
traefik.enable: "true"
@ -78,10 +79,8 @@ When the HMAC is good, and the timestamp is in the future,
the token is a valid authentication.
This technique means there is no persistent server storage.
If you use the default of pulling the session secret from the OS PRNG,
then everybody will have to log in again every time the server restarts.
You can use the `-secret` argument to provide a persistent secret,
so this won't happen.
If you don't want keys to persist across service invocations / reboots,
you can pass in `-secret /dev/urandom`.
Some things,
like WebDAV,

7
build.sh Executable file
View File

@ -0,0 +1,7 @@
#! /bin/sh
set -e
tag=git.woozle.org/neale/simpleauth:latest
docker buildx --push --tag $tag $(dirname $0)/.

View File

@ -1,9 +0,0 @@
#! /bin/sh
set -e
tag=git.woozle.org/neale/simpleauth
cd $(dirname $0)/..
docker build -t $tag -f build/Dockerfile .
docker push $tag

View File

@ -1,25 +0,0 @@
#! /bin/sh
case $1 in
-h|-help|--help)
echo "Usage: $0 TARGET"
echo
echo "Sets CI build variables for gitlab"
exit 1
;;
esac
branch=$(git symbolic-ref -q --short HEAD)
if [ "$branch" = "main" ]; then
branch=latest
fi
printf "Branch: %s\n" "$branch"
printf "::set-output name=branch::%s\n" "$branch"
printf "::set-output name=tag::%s\n" "$branch"
# I think it will use whichever comes last
git tag --points-at HEAD | while read tag; do
printf "Tag: %s\n" "$tag"
printf "::set-output name=tag::%s\n" "$tag"
done

View File

@ -113,7 +113,7 @@ func main() {
)
secretPath := flag.String(
"secret",
"/dev/urandom",
"/run/secrets/simpleauth.key",
"Path to a file containing some sort of secret, for signing requests",
)
htmlPath := flag.String(