TheAnachronism/docspell
1
0
Fork 0
mirror of https://github.com/TheAnachronism/docspell.git synced 2025-06-22 02:18:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Generate random server secret if not provided from config

Browse Source
This commit is contained in:
eikek
2021-10-25 00:21:03 +02:00
parent 4e5924d796
commit 94b26a1721
2 changed files with 22 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
modules/restserver/src/main/resources/reference.conf
View File

@ -47,8 +47,9 @@ docspell.server {
# The secret for this server that is used to sign the authenicator # The secret for this server that is used to sign the authenicator
# tokens. If multiple servers are running, all must share the same # tokens. If multiple servers are running, all must share the same
# secret. You can use base64 or hex strings (prefix with b64: and # secret. You can use base64 or hex strings (prefix with b64: and
# hex:, respectively). # hex:, respectively). If empty, a random secret is generated.
server-secret = "hex:caffee" # Example: b64:YRx77QujCGkHSvll0TVEmtTaw3Z5eXr+nWMsEJowgKg=
server-secret = ""
# How long an authentication token is valid. The web application # How long an authentication token is valid. The web application
# will get a new one periodically. # will get a new one periodically.

21
modules/restserver/src/main/scala/docspell/restserver/ConfigFile.scala
View File

@ -6,6 +6,8 @@
package docspell.restserver package docspell.restserver
import java.security.SecureRandom
import cats.Semigroup import cats.Semigroup
import cats.data.{Validated, ValidatedNec} import cats.data.{Validated, ValidatedNec}
import cats.effect.Async import cats.effect.Async
@ -20,12 +22,14 @@ import docspell.restserver.auth.OpenId
import pureconfig._ import pureconfig._
import pureconfig.generic.auto._ import pureconfig.generic.auto._
import scodec.bits.ByteVector
object ConfigFile { object ConfigFile {
private[this] val unsafeLogger = org.log4s.getLogger
import Implicits._ import Implicits._
def loadConfig[F[_]: Async](args: List[String]): F[Config] = { def loadConfig[F[_]: Async](args: List[String]): F[Config] = {
val logger = Logger.log4s(org.log4s.getLogger) val logger = Logger.log4s(unsafeLogger)
ConfigFactory ConfigFactory
.default[F, Config](logger, "docspell.server")(args) .default[F, Config](logger, "docspell.server")(args)
.map(cfg => Validate(cfg)) .map(cfg => Validate(cfg))
@ -57,12 +61,25 @@ object ConfigFile {
def all(cfg: Config) = List( def all(cfg: Config) = List(
duplicateOpenIdProvider(cfg), duplicateOpenIdProvider(cfg),
signKeyVsUserUrl(cfg) signKeyVsUserUrl(cfg),
generateSecretIfEmpty(cfg)
) )
private def valid(cfg: Config): ValidatedNec[String, Config] = private def valid(cfg: Config): ValidatedNec[String, Config] =
Validated.validNec(cfg) Validated.validNec(cfg)
def generateSecretIfEmpty(cfg: Config): ValidatedNec[String, Config] =
if (cfg.auth.serverSecret.isEmpty) {
unsafeLogger.warn(
"No serverSecret specified. Generating a random one. It is recommended to add a server-secret in the config file."
)
val random = new SecureRandom()
val buffer = new Array[Byte](32)
random.nextBytes(buffer)
val secret = ByteVector.view(buffer)
valid(cfg.copy(auth = cfg.auth.copy(serverSecret = secret)))
} else valid(cfg)
def duplicateOpenIdProvider(cfg: Config): ValidatedNec[String, Config] = { def duplicateOpenIdProvider(cfg: Config): ValidatedNec[String, Config] = {
val dupes = val dupes =
cfg.openid cfg.openid