Skip to content

Add support for docker secrets via FILE__ variables - #501

Merged
notquitenothing merged 2 commits into
voidauth:mainfrom
MathiasSM:patch-1
Jul 19, 2026
Merged

Add support for docker secrets via FILE__ variables#501
notquitenothing merged 2 commits into
voidauth:mainfrom
MathiasSM:patch-1

Conversation

@MathiasSM

Copy link
Copy Markdown
Contributor

Description

This PR adds support for docker secrets, by reading configuration options from either environment variables (the usual) or the given files (path provided via FILE__VAR env vars).

I did minimal changes to the config.ts; I manually tested it works. I'm open to suggestions on how to reword documentation or even the base compose.yml to indicate how to use secrets.

For context, something like the following works:

# Add the minimal required secrets to ./secrets
mkdir secrets
echo -n 'some_password' > secrets/db_password
echo -n 'very_long_and_longer_and_longer_storage_key' > secrets/storage_key
# compose.yaml: Replace the vars by FILE__ vars and add docker secrets
services:
  voidauth: 
    image: voidauth/voidauth:latest
    restart: unless-stopped
    volumes:
      - ./voidauth/config:/app/config
      # Only required for declaring OIDC Apps via docker labels (see OIDC-Setup documentation)
      # - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      - "3000:3000" # may not be needed, depending on reverse-proxy setup
      # - "3890:3890" # only needed if LDAP Server is enabled
    environment:
      # Required environment variables
      # See https://voidauth.app/#/Getting-Started?id=environment-variables for a list of possible environment variables
      APP_URL: # required
      DB_ADAPTER: postgres # this is the default value
      DB_HOST: voidauth-db # required
      FILE__DB_PASSWORD: /run/secrets/db_password
      FILE__STORAGE_KEY: /run/secrets/storage_key
    secrets:
      - db_password
      - storage_key
    depends_on:
      voidauth-db:
        condition: service_healthy

  voidauth-db:
    image: postgres:18
    restart: unless-stopped
    environment:
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
    ports:
      # NOTE: Had to map the port to access via localhost for local development
      - 54320:5432
    volumes:
      - ./voidauth/db:/var/lib/postgresql/18/docker
    secrets:
      - db_password
    healthcheck:
      test: "pg_isready -U postgres -h localhost"

secrets:
  db_password:
    file: ./secrets/db_password
  storage_key:
    file: ./secrets/storage_key
# For local dev:
APP_URL="http://localhost:3000"
DB_HOST="localhost"
DB_PORT=54320
FILE__STORAGE_KEY=./secrets/storage_key
FILE__DB_PASSWORD=./secrets/db_password

Related Tickets & Documents

I couldn't find any recent or old issue or PR related to docker secrets. Let me know if I should open one to track this feature.

About docker secrets: https://docs.docker.com/reference/compose-file/secrets/

AI Usage

I did not use AI to write this code.

Screenshots

N/A

@notquitenothing

Copy link
Copy Markdown
Collaborator

Thank you for your contribution! This is quite clever, and implements a feature I have been holding on the back-burner. I will take a closer look at this and do some testing, and will let you know if I have any feedback

@notquitenothing
notquitenothing merged commit 070d678 into voidauth:main Jul 19, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants