+2

server/src/config-template.toml

reviewed

··· 37 37 # JWT signing token 38 38 # 39 39 # Set this to the Base64 encoding of some random data. 40 40 + # You can also set it via the `ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64` environment 41 41 + # variable. 40 42 token-hs256-secret-base64 = "%token_hs256_secret_base64%" 41 43 42 44 # Database connection

+18

server/src/config.rs

reviewed

··· 25 25 /// This is useful for deploying to certain application platforms like Fly.io 26 26 const ENV_CONFIG_BASE64: &str = "ATTIC_SERVER_CONFIG_BASE64"; 27 27 28 28 + /// Environment variable storing the Base64-encoded HS256 JWT secret. 29 29 + const ENV_TOKEN_HS256_SECRET_BASE64: &str = "ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64"; 30 30 + 28 31 #[derive(Clone)] 29 32 pub struct JwtKeys { 30 33 pub decoding: JwtDecodingKey, ··· 100 103 /// Set this to the base64 encoding of a randomly generated secret. 101 104 #[serde(rename = "token-hs256-secret-base64")] 102 105 #[serde(deserialize_with = "deserialize_base64_jwt_secret")] 106 106 + #[serde(default = "JwtKeys::load_from_env")] 103 107 #[derivative(Debug = "ignore")] 104 108 pub token_hs256_secret: JwtKeys, 105 109 } ··· 183 187 #[serde(rename = "default-retention-period")] 184 188 #[serde(with = "humantime_serde", default = "default_default_retention_period")] 185 189 pub default_retention_period: Duration, 190 190 + } 191 191 + 192 192 + impl JwtKeys { 193 193 + fn load_from_env() -> Self { 194 194 + let s = env::var(ENV_TOKEN_HS256_SECRET_BASE64) 195 195 + .expect("The HS256 secret must be specified in either token_hs256_secret or the ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64 environment."); 196 196 + 197 197 + let decoding = JwtDecodingKey::from_base64_secret(&s) 198 198 + .expect("Failed to load as decoding key"); 199 199 + let encoding = JwtEncodingKey::from_base64_secret(&s) 200 200 + .expect("Failed to load as decoding key"); 201 201 + 202 202 + Self { decoding, encoding } 203 203 + } 186 204 } 187 205 188 206 impl CompressionConfig {