Solved Manifest Environment Variable

[paul.toone]

I was looking on the form to see if there was a way to add a custom environment variable via the manifest file. I have a container for a custom app that has one component that needs to be kept private. I am posting the image publicly on docker hub and would generally put this variable in via the Dockerfile but since it's public, I'd like to keep this one component secret.

So, is there a way to set a custom environment variable from the manifest file?

[BrutalBirdie]

@paul-toone sound a lot like you want to protect a software key or sort of.
I am unsure if this is possible.

[paul.toone]

@brutalbirdie Close, it's the apps salt password.

[BrutalBirdie]

@paul-toone and the salt password is unique for every instance you deploy with your custom app, right?

[paul.toone]

@brutalbirdie I'm moving an app that is already in production, so my salt doesn't change; but I don't want it out in public. For every new install, yes, the salt is unique.

[mehdi]

@paul-toone What you should do in this case is use the localstorage addon, then store the secret in question in /app/data in a file. If it's a salt, you can also generate it on the first run if the file in question does not exist.

Example from the start.sh of one of my apps:

if [ ! -f /app/data/session.secret ]; then
  dd if=/dev/urandom bs=256 count=1 | base64 > /app/data/session.secret
fi

[paul.toone]

@mehdi I was hoping it could be done on deployment. Currently, I just have to go in from the host, edit the salt in the local storage add-on I'm using.

But, I know Cloudron is mostly for new apps, not migrating existing apps over, so I figured it would not be possible in the manifest file.

[girish]

@paul-toone The start.sh "pattern" is like this - https://git.cloudron.io/cloudron/rocketchat-app/-/blob/master/Dockerfile#L34 . It's set as the CMD in Dockerfile. So when the app deploys, it runs as the first thing and the code that @mehdi posted would then generate the secret and save it in the app store. So, it's automated as part of the deployment.

[paul.toone]

@girish Right, but this is a container that is a migration with an existing salt. It's alright, I can just manually put the salt in as I have to restore the pgsql each time I deploy to test anyway. I appreciate the response though.

[girish]

@paul-toone Don't know if this helps your automated install but there is a CLI command cloudron push <file> /app/data/session.secret that can help you copy a file into the app's local storage. You can also use cloudron exec -- bash -c "echo 'mysecret' > /app/data/session.secret"

[paul.toone]

@girish Thank you for those commands. I think I'll just use the cloudron push after I run cloudron install on my image server.

Also, not sure if there is a specific way to go about this but I could strip this down a bit to have a base install for the app if it's of use to the Cloudron community. I'm sure it would have to be polished by the devs but it is an install for Timetrex CE which is a timeclock software that our company uses.