Add support for file-based environment variables in environment-to-ini

[aminosbh]

Improve environment-to-ini to allow for file content to be set as the value of an environment variable.
Useful when using docker secret and were the secret is mounted as a file in /run/secrets/<SECRET_NAME>.

Any settings in app.ini can be set or overridden with the content of a file by defining an environment variable of the form: GITEA__section_name__KEY_NAME__FILE that points to a file.

Fixes #19856

[KarolNi]

Fixes #10311

[nesono]

Any reason why this PR was discontinued? This change would be extremely useful imho.

[Doddophonique]

I agree, this is a key functionality for a lot of production environments. Having it embedded in the code is far better than implementing potentially unsafe workarounds.

[lunny]

Maybe another prefix like GITEA__FILE__ is better than suffix.

[nesono]

Maybe another prefix like GITEA__FILE__ is better than suffix.

I found suffixed version to be quite standard with some other Docker containers, but I don't have a strong opinion. Could you land this change for us, @lunny ? It looks like you are a member.

Then, I was writing my own wrapper now, based a previous issue that was discussed here, which works as a workaround for me for now. Here's the code for completion (I modified the original prosposal to be compliant with /bin/sh syntax.

# This file has been copied from the original Docker container, as follows:
# docker run gitea/gitea:1.18.0
# docker exec <container_name>> cat /usr/bin/entrypoint > gitea.entrypoint.sh

# The patch starts here. It's a rewritten form of what was posted here
# https://github.com/go-gitea/gitea/issues/10311.
# >>> SNIP
export_secret_as_env_var()
{
    secret=$1
    envFile="${secret}_FILE"
    envFileName="$(printenv "${envFile}")"
    if [ -n "${envFileName}" ]; then
        if [ -f "${envFileName}" ]; then
          val=$(cat "${envFileName}")
          export "${secret}"="$val"
          echo "${secret} environment variable was set via secret ${envFileName}"
        else
          >&2 echo "Error: Secret ${secret} cannot be set via secret ${envFileName}. Not a file"
        fi
    else
        echo "Warn: ${secret} environment variable ist not defined in secret"
    fi
}

# Set environment variables by their respective secrets
export_secret_as_env_var "GITEA__database__PASSWD"
export_secret_as_env_var "GITEA__database__USER"
export_secret_as_env_var "GITEA__mailer__USER"
export_secret_as_env_var "GITEA__mailer__PASSWD"
# <<< SNAP

It seemed though, that the GITEA__database__PASSWD was already supported, maybe that's worthwhile to check.
I think a username should be protected, too, though. Adds yet another layer, even if it's small.

Cherrs and thanks for reading this far :)

[dynamicat]

Can someone review approve and merge this?

[wxiaoguang]

Maybe another prefix like GITEA__FILE__ is better than suffix.

"GITEA__FILE__foo__..." conflicts with "[FILE].foo", the "FILE" part might be parsed as the "section_name", according to existing rule "GITEA__section_name__KEY_NAME".

[wxiaoguang]

Suggested change

	if isFileBased {
	isFile, err := util.IsFile(value)
	if err != nil {
	log.Fatal("Unable to check if %s is a file. Error: %v", value, err)
	}
	if isFile {
	if content, err := os.ReadFile(value); err == nil {
	value = string(content)
	} else {
	log.Fatal("Failed to load value from file '%s': %v", value, err)
	}
	} else {
	log.Fatal("File '%s' not found", value)
	}
	}
	if isFileBased {
	if content, err := os.ReadFile(value); err == nil {
	value = string(content)
	} else {
	log.Fatal("Failed to load value from file %q: %v", value, err)
	}
	}

I guess this is enough?

[wxiaoguang]

Although there are some conflicts, I think this PR could be fine-tuned and merged.

Could maintainers with writer permission do some helps?

[silverwind]

Generally I think that what environment-to-ini does needs to move to the main application so that environment variables are recognized everywhere, not just with the docker container because docker is just one of many deployment option.

If someone wants to use env vars, they should be able to. This goes for systemd deployments, gitpod and more.

[wxiaoguang]

Replaced by Make environment-to-ini support loading key value from file #24832