Support for Docker secrets

[oaltun]

First thank you for this nice auth / user solution. I am trying to replace my current auth code with this, using the Docker image.

One feature I could not find in your image is the support for the Docker secrets.

Docker secrets seem to be the recommended way to pass secret values to images. Widely used images like official Postgresql image support them.

I use Docker Swarm Mode. In that mode instead of a docker-compose file you write a docker stack file. This is similar to a compose file, but different. Compose files also support secrets.

When using Docker secrets, for each secret environment variable XXX, in the Docker stack file we have something like:

services:
  fief:
    image: ...
    secrets:
      - XXX
    environment:
      XXX_FILE: /run/secrets/XXX

secrets:
    XXX:
      external: true

and in the fief/settings.py file we would have something like:

import os
from dotenv import load_dotenv
load_dotenv()

def secret(name, default=None):
    try:
        with open(f"/run/secrets/{name}_FILE", "r") as myfile:
            return myfile.read()
    except:
        return os.getenv(name) or default
...

class Settings(BaseSettings):
    ...
    XXX = secret('XXX', default_value) 

We also need to add secret in the command line with a command like

printf "my super secret password" | docker secret create XXX -

I would be happy to work on a pull request if you like this approach.

[fief-bailiff[bot]]

Hail, @oaltun 👋 Welcome to Fief's kingdom!

Our team will get back to you very soon to help.

In the meantime, take a minute to star our repository ⭐️

Farewell!

[oaltun]

Another consideration is that the "env_file"s are not supported by Docker Swarm Mode.

[frankie567]

Hi @oaltun 👋

That would indeed be an interesting addition! Actually, it seems that Pydantic Settings natively supports Docker Secrets: https://docs.pydantic.dev/latest/usage/settings/#use-case-docker-secrets

Thus, the implementation seem quite straightforward! I would be glad to see a PR that try this and see how it goes.

[oaltun]

Nice, I will take a look on this.

[oaltun]

Hi @frankie567,

I confirm that Pydantic (^1.10.6) supports Docker secrets.

In my own code all I needed to do was to add

    class Config:
        secrets_dir = '/run/secrets'

in the Pydantic settings class definition.

That secrets_dir config is required, Pydantic does not load secrets otherwise.

For each secret XXX, the stack file needs to go like:

services:
  fief:
    image: ...
    secrets:
      - XXX

secrets:
    XXX:
      external: true

There is no need to add XXX_FILE related code, which is a bonus.

I added the secrets_dir config in my fork of fief/settings.py, but I am not sure how to build and test your development image. I can send a PR without testing, or if you can inform me on the steps to create and test your development image, I can send a PR after testing.

[frankie567]

Great! Yes, just open the PR, for such simple changes, it should be okay :)

[oaltun]

Nice, I opened the PR.