[hotfix] Prioritise API database secrets over .env #40
Conversation
WalkthroughThis update introduces a new mechanism for retrieving sensitive database credentials by prioritizing Docker secrets over environment variables. The environment setup logic and Docker Compose configuration are modified to use this approach, and a new utility function is added to handle secret-or-env fallback logic. Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant API_Service
participant Env_Package
participant Docker_Secrets
User->>API_Service: Start container
API_Service->>Env_Package: MakeEnv()
Env_Package->>Docker_Secrets: Try to read /run/secrets/postgres_user
alt Secret exists
Docker_Secrets-->>Env_Package: Return secret value
else Secret missing
Env_Package->>Env_Package: GetEnvVar("ENV_DB_USER_NAME")
end
Env_Package-->>API_Service: Provide DB credentials
Possibly related PRs
Poem
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
gocanto
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
env/env.go (1)
20-35: Remove redundant fallback logic and consider adding error logging.The implementation correctly prioritizes Docker secrets over environment variables, but there are some improvements to consider:
Redundant fallback: Line 34 is redundant since the
os.IsNotExist(err)case already handles the fallback on lines 30-32.Silent error handling: Other file read errors (permissions, I/O errors) are silently ignored, which could make debugging difficult in production.
Apply this diff to improve the implementation:
func GetSecretOrEnv(secretName string, envVarName string) string { secretPath := "/run/secrets/" + secretName // Try to read the secret file first. content, err := os.ReadFile(secretPath) if err == nil { return strings.TrimSpace(string(content)) } - // If the file does not exist, fall back to the environment variable. - if os.IsNotExist(err) { - return GetEnvVar(envVarName) // Use your existing function here - } - + // If the file does not exist or any other error occurs, fall back to the environment variable. + // Note: Consider adding logging for non-NotExist errors in production return GetEnvVar(envVarName) }
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
boost/factory.go(1 hunks)docker-compose.yml(1 hunks)env/env.go(1 hunks)
🧰 Additional context used
🧬 Code Graph Analysis (1)
boost/factory.go (1)
env/env.go (1)
GetSecretOrEnv(20-35)
🔇 Additional comments (3)
boost/factory.go (1)
75-77: No change required for ENV_DB_USER_PASSWORD namingThe environment variable name
ENV_DB_USER_PASSWORDcorrectly matches the existing pattern alongsideENV_DB_USER_NAME. The use ofGetSecretOrEnvto prioritize Docker secrets over env vars for database credentials is valid and enhances security.
- File: boost/factory.go
Lines 75–77:GetSecretOrEnv("postgres_user", "ENV_DB_USER_NAME"),
GetSecretOrEnv("postgres_password", "ENV_DB_USER_PASSWORD"),
GetSecretOrEnv("postgres_db", "ENV_DB_DATABASE_NAME")Security enhancement approved.
docker-compose.yml (2)
2-8: Well-structured Docker secrets configuration.The secrets configuration follows Docker Compose best practices:
- Uses environment variable substitution with sensible defaults
- Consistent file path structure under
./database/infra/secrets/- Secret names align with usage in the Go code
90-93: Correct secrets integration for the api service.The secrets configuration properly grants the api service access to the database credentials. The secret names match both the top-level definitions and the usage in the Go code.
Summary by CodeRabbit
New Features
Chores