Add secrets-common for shared secrets
Add a shared secrets file used across all destinations. Useful for things Github tokens or registry passwords. The secrets are added to a new file called `secrets-common` to highlight they are shared, and to avoid acciedentally inheriting a secret from the `secrets` file to `secrets.destination`.
This commit is contained in:
@@ -1,19 +1,20 @@
|
||||
require "dotenv"
|
||||
|
||||
class Kamal::Secrets
|
||||
attr_reader :secrets_file
|
||||
attr_reader :secrets_files
|
||||
|
||||
Kamal::Secrets::Dotenv::InlineCommandSubstitution.install!
|
||||
|
||||
def initialize(destination: nil)
|
||||
@secrets_file = [ *(".kamal/secrets.#{destination}" if destination), ".kamal/secrets" ].find { |f| File.exist?(f) }
|
||||
@secrets_files = \
|
||||
[ ".kamal/secrets-common", ".kamal/secrets#{(".#{destination}" if destination)}" ].select { |f| File.exist?(f) }
|
||||
end
|
||||
|
||||
def [](key)
|
||||
secrets.fetch(key)
|
||||
rescue KeyError
|
||||
if secrets_file
|
||||
raise Kamal::ConfigurationError, "Secret '#{key}' not found in #{secrets_file}"
|
||||
if secrets_files
|
||||
raise Kamal::ConfigurationError, "Secret '#{key}' not found in #{secrets_files.join(", ")}"
|
||||
else
|
||||
raise Kamal::ConfigurationError, "Secret '#{key}' not found, no secret files provided"
|
||||
end
|
||||
@@ -25,14 +26,8 @@ class Kamal::Secrets
|
||||
|
||||
private
|
||||
def secrets
|
||||
@secrets ||= parse_secrets
|
||||
end
|
||||
|
||||
def parse_secrets
|
||||
if secrets_file
|
||||
::Dotenv.parse(secrets_file)
|
||||
else
|
||||
{}
|
||||
@secrets ||= secrets_files.inject({}) do |secrets, secrets_file|
|
||||
secrets.merge!(::Dotenv.parse(secrets_file))
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
Reference in New Issue
Block a user