[FEAT] Storing Secrets

[TonyBrobston]

My apologies if this is covered somewhere and I missed it. Is there a pattern for dealing with secrets, passwords, things you don't want directly in your config?

I see that Frigate uses a pattern where you can create environment variables prefixed with FRIGATE_ and then reference them in yaml by wrapping the environment variable in curly braces {FRIGATE_MQTT_PASSWORD}, does something like this exist in Double Take?

If Double Take does not have this yet, it seems like using the same pattern as Frigate could make this straight forward for users?

My main issue is that my mqtt-broker has a username/password and I would like to keep my mqtt password out of my config file; often times I leave these config files open source and reference them.

Thanks for the work on this repo, it is a much needed tool and I look forward to working with it more!

[jakowenko]

Hey @TonyBrobston, thanks for the great suggestion. I pushed a new beta build to include this ability. I modeled it similar to how Home Assistant does it.

Let me know what you think!

Create a secrets.yml file in the /config directory to store private information outside of config.yml. Use !secret and an identifier.

mqtt:
  host: localhost
  username: mqtt
  password: !secret mqtt_password

detectors:
  compreface:
    url: localhost:8000
    key: !secret compreface_key

The secrets.yaml file contains the corresponding value assigned to the identifier.

mqtt_password: <password>
compreface_key: <api-key>

[TonyBrobston]

Awesome, I'll give that a shot and report back. I assume there is a beta docker image tag? I'll take a look when I have time.

Thanks!

[jakowenko]

Awesome, I'll give that a shot and report back. I assume there is a beta docker image tag? I'll take a look when I have time.

Thanks!

jakowenko/double-take:beta is the beta build. It's only for amd64, so if you are running on a Pi you'll have to wait until I release this 1.7.0 which will probably be tomorrow. Just wanted you to test this feature first :). I did push a little update to use the Home Assistant /config/secrets.yaml file if you are running the add-on, I have it explained here.

[TonyBrobston]

Sounds good. I'm currently running on a server with an AMD Ryzen Threadripper, so beta should be good.

[jakowenko]

This was included in the latest release v1.7.0. I'm going to close this for now, but feel free to reopen if you run into any issues. Thanks again for the feature request!

[TonyBrobston]

I finally got around to using this, it works great!

I was able to back everything up to a github repo and keep my secrets out!

[jakowenko]

I finally got around to using this, it works great!

I was able to back everything up to a github repo and keep my secrets out!

Awesome! So happy to hear it's working for you.