filesecrets

README

This is a fork of https://github.com/ben-freke/caddy-file-secrets.git which fixes a thing.

Caddy File Secrets

A Caddy v2 module providing a secrets Caddyfile directive which reads secret values from files into memory and exposes them as placeholders {secret.NAME} for use elsewhere in the config.

This was designed for use with Docker Secrets, where secrets stored in memory and mounted in /run/secrets on the container's filesystem.

• Multiple secrets supported
• Values are loaded at provision time and stored only in memory
• Usable in placeholders like {secret.bearer_token}

Caddyfile usage

Place the secrets handler before other handlers that use the placeholders in the same site block:

:443 {
    tls internal

    secrets {
        file bearer_token /run/secrets/bearer_token
        file api_key      /run/secrets/api_key
    }

    reverse_proxy site:80 {
        header_up Authorization "Bearer {secret.bearer_token}"
        header_up X-API-Key     "{secret.api_key}"
    }
}

Build

This module is an HTTP handler directive. Build a Caddy binary including it with xcaddy:

xcaddy build \
    --with git.sr.ht/~aaanntan/filesecrets

Or add to an existing xcaddy build.

Security notes

• Ensure secret files have restrictive permissions and only the Caddy process user can read them.
• The module does not log secret contents and stores them only in memory.
• If files change on disk after startup, the in-memory value is not reloaded (by design).

Documentation

Index

• type FileSpec
• type Secrets
  • func (Secrets) CaddyModule() caddy.ModuleInfo
  • func (s *Secrets) Provision(_ caddy.Context) error
  • func (s Secrets) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyhttp.Handler) error
  • func (s *Secrets) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

Types

type FileSpec

type FileSpec struct {
	Name string `json:"name,omitempty"`
	Path string `json:"path,omitempty"`
}

type Secrets

type Secrets struct {
	Files []FileSpec `json:"files,omitempty"`
	// contains filtered or unexported fields
}

func (Secrets) CaddyModule

func (Secrets) CaddyModule() caddy.ModuleInfo

func (*Secrets) Provision

func (s *Secrets) Provision(_ caddy.Context) error

Provision reads files and stores values in memory.

func (Secrets) ServeHTTP

func (s Secrets) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyhttp.Handler) error

ServeHTTP seeds the replacer with secret values then calls next.

func (*Secrets) UnmarshalCaddyfile

func (s *Secrets) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

UnmarshalCaddyfile parses the Caddyfile block.