rpc_secret in garage.toml

[arcoast]

I'd set this up before you produced the selfhosting manual documentation, so I might be missing something, but I've also looked at the install & bootstrapping scripts and couldn't obviously see it there, but I wondered if the rpc_secret in the garage.toml file should also be randomly generated.

I've no experience with Garage or S3 so I have no knowledge of how important it should be, but I did generate my own with

openssl rand -hex 32

Just wondering if I'm being overly cautious or conversely whether the bootstrapping scripts and selfhosting instructions should take it into account?

[arcoast]

Done a bit of reading and the easiest option might actually be to use an environmental variable, then garage.toml can be static and we could run the garage container like this.

  garage:
    image: dxflrs/garage:v2.2.0
    ports:
      - "${HOST_PORT_GARAGE_S3:-3900}:3900"
    environment:
      GARAGE_RPC_SECRET: ${GARAGE_RPC_SECRET}
      # GARAGE_RPC_SECRET_FILE: /run/typetype-secrets/garage_rpc_secret
    volumes:
      - typetype_secrets:/run/typetype-secrets
      - ./garage.toml:/etc/garage.toml:ro
      - garage_meta:/var/lib/garage/meta
      - garage_data:/var/lib/garage/data
    restart: unless-stopped

# Generate with openssl rand -hex 32
GARAGE_RPC_SECRET=42e8720bde3faf231625459b4ef2b0c2152804953e28f4ac1d14d3a970d837f5

That also raises the possibility of using the existing typetype-secret busybox container to generate the secret file if desired.

[Priveetee]

Mmmm yeah, that’s actually a cleaner option. Thanks for digging into it and for pointing me at the env-var path.

Garage supports GARAGE_RPC_SECRET and GARAGE_RPC_SECRET_FILE, so keeping garage.toml static and generating GARAGE_RPC_SECRET in .env fits the rest of the stack better than rewriting the TOML file.

Docs: https://garagehq.deuxfleurs.fr/documentation/reference-manual/configuration/#rpc_secret

I’ll update the setup/bootstrap flow around that:

• add GARAGE_RPC_SECRET to the generated env values;
• pass it to the Garage container;
• keep existing installs safe by only generating it when missing or still on a placeholder/default value.

For existing installs, ur openssl rand -hex 32 value is exactly the right format, so you’re good there.

Thx :p

[arcoast]

It's only rubber ducking by an end user, you're the one that's done all the hard work!