feat(config): add secret support

Author: mpolitzer

compose.individual-services.yaml

@@ -43,6 +43,8 @@ services:
     networks:
       - devnet
     restart: "no"
+    secrets:
+      - database_connection
     environment:
       <<: *env
 
@@ -58,6 +60,11 @@ services:
       - devnet
     ports:
       - "10001:10001" # Supervisor
+    secrets:
+      - auth_mnemonic
+      - blockchain_http_endpoint
+      - blockchain_ws_endpoint
+      - database_connection
     environment:
       <<: *env
 
@@ -76,6 +83,9 @@ services:
     ports:
       - "10002:10002" # Supervisor
       - "10012:10012" # Inspect Service
+    secrets:
+      - auth_mnemonic
+      - database_connection
     environment:
       <<: *env
 
@@ -89,6 +99,8 @@ services:
       - devnet
     ports:
       - "10003:10003" # Supervisor
+    secrets:
+      - database_connection
     environment:
       <<: *env
 
@@ -104,6 +116,10 @@ services:
       - devnet
     ports:
       - "10004:10004" # Supervisor
+    secrets:
+      - auth_mnemonic
+      - blockchain_http_endpoint
+      - database_connection
     environment:
       <<: *env
 
@@ -118,10 +134,24 @@ services:
     ports:
       - "10005:10005" # Supervisor
       - "10011:10011" # Jsonrpc API service
+    secrets:
+      - auth_mnemonic
+      - blockchain_http_endpoint
+      - database_connection
     environment:
       <<: *env
 volumes:
   node_data:
 
 networks:
   devnet:
+
+secrets:
+  auth_mnemonic:
+    file: test/secrets/auth_mnemonic.txt
+  blockchain_http_endpoint:
+    file: test/secrets/blockchain_http_endpoint.txt
+  blockchain_ws_endpoint:
+    file: test/secrets/blockchain_ws_endpoint.txt
+  database_connection:
+    file: test/secrets/database_connection.txt

compose.yaml

@@ -1,14 +1,14 @@
 x-env: &env
   CARTESI_LOG_LEVEL: info
-  CARTESI_BLOCKCHAIN_HTTP_ENDPOINT: http://ethereum_provider:8545
-  CARTESI_BLOCKCHAIN_WS_ENDPOINT: ws://ethereum_provider:8545
+  CARTESI_BLOCKCHAIN_HTTP_ENDPOINT_FILE: /run/secrets/blockchain_http_endpoint
+  CARTESI_BLOCKCHAIN_WS_ENDPOINT_FILE: /run/secrets/blockchain_http_endpoint
   CARTESI_BLOCKCHAIN_ID: 13370
   CARTESI_CONTRACTS_INPUT_BOX_ADDRESS: 0xc70074BDD26d8cF983Ca6A5b89b8db52D5850051
   CARTESI_CONTRACTS_AUTHORITY_FACTORY_ADDRESS: 0xC7003566dD09Aa0fC0Ce201aC2769aFAe3BF0051
   CARTESI_CONTRACTS_APPLICATION_FACTORY_ADDRESS: 0xc7006f70875BaDe89032001262A846D3Ee160051
   CARTESI_CONTRACTS_SELF_HOSTED_APPLICATION_FACTORY_ADDRESS: 0xc700285Ab555eeB5201BC00CFD4b2CC8DED90051
-  CARTESI_DATABASE_CONNECTION: postgres://postgres:password@database:5432/rollupsdb?sslmode=disable
-  CARTESI_AUTH_MNEMONIC: "test test test test test test test test test test test junk"
+  CARTESI_DATABASE_CONNECTION_FILE: /run/secrets/database_connection
+  CARTESI_AUTH_MNEMONIC_FILE: /run/secrets/auth_mnemonic
 
 services:
   ethereum_provider:
@@ -42,6 +42,8 @@ services:
         condition: service_healthy
     networks:
       - devnet
+    secrets:
+      - database_connection
     restart: "no"
     environment:
       <<: *env
@@ -62,6 +64,11 @@ services:
       - "10000:10000" # Supervisor
       - "10011:10011" # Jsonrpc API service
       - "10012:10012" # Inspect Service
+    secrets:
+      - auth_mnemonic
+      - blockchain_http_endpoint
+      - blockchain_ws_endpoint
+      - database_connection
     environment:
       <<: *env
 
@@ -70,3 +77,13 @@ volumes:
 
 networks:
   devnet:
+
+secrets:
+  auth_mnemonic:
+    file: test/secrets/auth_mnemonic.txt
+  blockchain_http_endpoint:
+    file: test/secrets/blockchain_http_endpoint.txt
+  blockchain_ws_endpoint:
+    file: test/secrets/blockchain_ws_endpoint.txt
+  database_connection:
+    file: test/secrets/database_connection.txt

internal/config/auth/auth.go

@@ -7,7 +7,6 @@ import (
 	"context"
 	"fmt"
 	"math/big"
-	"os"
 
 	"github.com/ethereum/go-ethereum/accounts/abi/bind"
 	"github.com/ethereum/go-ethereum/core/types"
@@ -42,24 +41,6 @@ func GetTransactOpts(chainId *big.Int) (*bind.TransactOpts, error) {
 			return nil, err
 		}
 		return bind.NewKeyedTransactorWithChainID(privateKey, chainId)
-	case AuthKindMnemonicFile:
-		mnemonicFile, err := GetAuthMnemonicFile()
-		if err != nil {
-			return nil, err
-		}
-		mnemonic, err := os.ReadFile(mnemonicFile)
-		if err != nil {
-			return nil, err
-		}
-		accountIndex, err := GetAuthMnemonicAccountIndex()
-		if err != nil {
-			return nil, err
-		}
-		privateKey, err := ethutil.MnemonicToPrivateKey(string(mnemonic), accountIndex.Value)
-		if err != nil {
-			return nil, err
-		}
-		return bind.NewKeyedTransactorWithChainID(privateKey, chainId)
 	case AuthKindPrivateKeyVar:
 		privateKey, err := GetAuthPrivateKey()
 		if err != nil {
@@ -70,20 +51,6 @@ func GetTransactOpts(chainId *big.Int) (*bind.TransactOpts, error) {
 			return nil, err
 		}
 		return bind.NewKeyedTransactorWithChainID(key, chainId)
-	case AuthKindPrivateKeyFile:
-		privateKeyFile, err := GetAuthPrivateKeyFile()
-		if err != nil {
-			return nil, err
-		}
-		privateKey, err := os.ReadFile(privateKeyFile)
-		if err != nil {
-			return nil, err
-		}
-		key, err := crypto.HexToECDSA(ethutil.TrimHex(string(privateKey)))
-		if err != nil {
-			return nil, err
-		}
-		return bind.NewKeyedTransactorWithChainID(key, chainId)
 	case AuthKindAWS:
 		awsc, err := aws_cfg.LoadDefaultConfig(context.Background())
 		if err != nil {

internal/config/generate/Config.toml

@@ -100,12 +100,14 @@ An unique identifier representing a blockchain network."""
 used-by = ["evmreader", "claimer", "node"]
 
 [blockchain.CARTESI_BLOCKCHAIN_HTTP_ENDPOINT]
+file = true
 go-type = "URL"
 description = """
 HTTP endpoint for the blockchain RPC provider."""
 used-by = ["evmreader", "claimer", "node"]
 
 [blockchain.CARTESI_BLOCKCHAIN_WS_ENDPOINT]
+file = true
 go-type = "URL"
 description = """
 WebSocket endpoint for the blockchain RPC provider."""
@@ -220,34 +222,21 @@ omit = true
 used-by = ["claimer", "node", "cli"]
 
 [auth.CARTESI_AUTH_PRIVATE_KEY]
+file = true
 go-type = "RedactedString"
 description = """
 The node will use this private key to sign transactions."""
 omit = true
 used-by = ["claimer", "node", "cli"]
 
-[auth.CARTESI_AUTH_PRIVATE_KEY_FILE]
-go-type = "string"
-description = """
-The node will use the private key contained in this file to sign transactions."""
-omit = true
-used-by = ["claimer", "node", "cli"]
-
 [auth.CARTESI_AUTH_MNEMONIC]
+file = true
 go-type = "RedactedString"
 description = """
 The node will use the private key generated from this mnemonic to sign transactions."""
 omit = true
 used-by = ["claimer", "node", "cli"]
 
-[auth.CARTESI_AUTH_MNEMONIC_FILE]
-go-type = "string"
-description = """
-The node will use the private key generated from the mnemonic contained in this file
-to sign transactions."""
-omit = true
-used-by = ["claimer", "node", "cli"]
-
 [auth.CARTESI_AUTH_MNEMONIC_ACCOUNT_INDEX]
 default = "0"
 go-type = "RedactedUint"
@@ -281,6 +270,7 @@ used-by = ["claimer", "node", "cli"]
 
 [database.CARTESI_DATABASE_CONNECTION]
 default = ""
+file = true
 go-type = "URL"
 description = """
 Postgres endpoint in the 'postgres://user:password@hostname:port/database' format (URL).

internal/config/generate/code.go

@@ -117,6 +117,8 @@ package config
 
 import (
 	"fmt"
+	"os"
+	"strings"
 
 	"github.com/spf13/viper"
 )
@@ -131,6 +133,10 @@ func init() {
 const (
 {{ range . -}}
 	{{ toConstName .Name }} = "{{ .Name }}"
+{{ end }}
+	// File variants
+{{ range . -}}
+	{{ if .File -}}{{ toConstName .Name }}_FILE = "{{ .Name }}_FILE"{{ end }}
 {{ end -}}
 )
 
@@ -209,6 +215,14 @@ func (c *NodeConfig) To{{ capitalize $service }}Config() *{{ capitalize $service
 // Get{{ toFieldName .Name }} returns the value for the environment variable {{ .Name }}.
 func Get{{ toFieldName .Name }}() ({{ .GoType }}, error) {
 	s := viper.GetString({{ toConstName .Name }})
+	{{ if .File -}} if s == "" {
+		filename := viper.GetString({{toConstName .Name}}_FILE)
+		contents, err := os.ReadFile(filename)
+		if err != nil {
+			return notDefined{{ .GoType }}(), fmt.Errorf("failed to parse %s: %w", {{ toConstName .Name }}_FILE, err)
+		}
+		s = strings.TrimSpace(string(contents))
+	} {{- end }}
 	if s != "" {
 		v, err := {{ toGoFunc .GoType }}(s)
 		if err != nil {

internal/config/generate/env.go

@@ -23,6 +23,9 @@ type Env struct {
 	// If defined omit the field from the generated Config struct
 	Omit bool `toml:"omit"`
 
+	// Configuration also has a "_FILE" variant that should be searched
+	File bool `toml:"file"`
+
 	// List of services that use this environment variable.
 	// Possible values: "advancer", "claimer", "cli", "evm-reader", "jsonrpc-api", "node", "validator"
 	UsedBy []string `toml:"used-by"`