How to use Docker Secrets for Pgwatch2 collector in Push model?

[schiggi]

Hey there,

Trying to use the metrics collector only for pushing stats to Prometheus instance. Works well via YAML files and plain password. Working in Docker Swarm environment. Now I wanted to use .pgpass to not store password in yaml.

How would I mount the file/secret into the Docker container? What would be the correct path within the container in order to be recognized by internal psql? I removed the password line from the yaml file.

My docker-compose so far

pgwatch2-collector:
    image: cybertec/pgwatch2-daemon
    environment:
      PW2_CONFIG: /etc/pgwatch2/config/instances.yaml
      PW2_DATASTORE: prometheus
    configs:
      - source: pgwatch2_instances.yaml
        target: /etc/pgwatch2/config/instances.yaml
    networks:
      - private-db-test
      - private-prometheus
    secrets:
      - pgwatch2_user_password

[pashagolub]

Please, check this answer. It shows how to use both env var and password file

[schiggi]

Thank you for the quick reply. But what would be the destination of .pgpass mount point within the docker image? Any specific permissions that I need to think about? Or do I really have to create my own build?

With official Postgres image, we are using Secrets (or other text files) like this

db:
    image: postgres
    environment:
      POSTGRES_PASSWORD_FILE: /run/secrets/pgwatch2_user_password
    networks:
      - private-db-test
    secrets:
      - pgwatch2_user_password

Meaning that on the Docker image itself there needs to be a command to read the file. Would be nice if PGWatch2 supports that.

[pashagolub]

From the manual:

The file .pgpass in a user's home directory can contain passwords to be used if the connection requires a password.
...
On Unix systems, the permissions on a password file must disallow any access to world or group; achieve this by a command such as chmod 0600 ~/.pgpass. If the permissions are less strict than this, the file will be ignored.

I'm not sure under which user processes are running in Docker container (root?).