feat: secrets file #64

Cargo.toml

@@ -29,9 +29,9 @@ strip = true
 
 [patch.crates-io]
 sqlx = { git = "https://github.com/bitshock-src/sqlx.git", tag = "rustls-native-certs-aws-lc-rs" }
-sqlx-core ={ git = "https://github.com/bitshock-src/sqlx.git", tag = "rustls-native-certs-aws-lc-rs" }
-sqlx-macros = { git = "https://github.com/bitshock-src/sqlx.git", tag = "rustls-native-certs-aws-lc-rs"  }
-sqlx-macros-core = { git = "https://github.com/bitshock-src/sqlx.git", tag = "rustls-native-certs-aws-lc-rs"  }
-sqlx-mysql = { git = "https://github.com/bitshock-src/sqlx.git", tag = "rustls-native-certs-aws-lc-rs"  }
-sqlx-postgres = { git = "https://github.com/bitshock-src/sqlx.git", tag = "rustls-native-certs-aws-lc-rs"  }
-sqlx-sqlite = { git = "https://github.com/bitshock-src/sqlx.git", tag = "rustls-native-certs-aws-lc-rs"  }
+sqlx-core = { git = "https://github.com/bitshock-src/sqlx.git", tag = "rustls-native-certs-aws-lc-rs" }
+sqlx-macros = { git = "https://github.com/bitshock-src/sqlx.git", tag = "rustls-native-certs-aws-lc-rs" }
+sqlx-macros-core = { git = "https://github.com/bitshock-src/sqlx.git", tag = "rustls-native-certs-aws-lc-rs" }
+sqlx-mysql = { git = "https://github.com/bitshock-src/sqlx.git", tag = "rustls-native-certs-aws-lc-rs" }
+sqlx-postgres = { git = "https://github.com/bitshock-src/sqlx.git", tag = "rustls-native-certs-aws-lc-rs" }
+sqlx-sqlite = { git = "https://github.com/bitshock-src/sqlx.git", tag = "rustls-native-certs-aws-lc-rs" }

README.md

@@ -199,6 +199,9 @@ offer-service:
 
 # Persistence Settings for Discovery and Offer data  
 store:
+
+# Optional secrets file to replace tokens in specific configuration fields
+secrets:
 ```
 
 See the service entries below for complete configuration manual.
@@ -240,6 +243,39 @@ lnurl-service:
   address: "127.0.0.1:8080"
 ```
 
+#### Secrets Expansion
+
+Secrets are read from a secrets file, and can be used to replace tokens in a configuration file.
+
+The secrets file format is a standard dot file:
+
+```shell
+NAME="value"
+```
+
+Example:
+
+```shell
+MYSQL_USERNAME=root
+MYSQL_PASSWORD=mysql
+POSTGRES_USERNAME=postgres
+POSTGRES_PASSWORD=postgres
+```
+
+Secrets expansion works the same way as env var expansion, but with the different template syntax:
+
+```
+{secret.SECRET_NAME}
+```
+
+Example:
+
+```yaml
+    database-uri: "postgres://{secret.POSTGRES_USERNAME}:{secret.POSTGRES_PASSWORD}@localhost:5432/discovery"
+```
+
+Unlike env var expansion, secret expansion is selective. Only specific configuration fields have access to secrets.
+
 ## Liquidity Bias
 
 Optional Liquidity Bias will prioritize nodes with inbound capacity at the moment of selection. If no nodes are in range of the capacity bias, selection will fall back to standard weight selection.
@@ -439,7 +475,7 @@ lnurl-service:
   # QR light gray level
   bech32-qr-light: 255
   # QR dark gray level
-  bech32-qr-dark: 0
+  bech32-qr-dark: 0 
 ```
 
 ### Consistent Backend-Selection
@@ -555,13 +591,14 @@ Both Discovery and Offer stores support these storage backends:
 store:
   discover:  # or 'offer'
     type: "database"
-    # Database connection URL (SQLite/MySQL/PostgreSQL)
-    database-url: "connection-url"
+    # Database connection URI (SQLite/MySQL/PostgreSQL)
+    # Supports secrets expansion
+    database-uri: "connection-url" 
     # Maximum number of concurrent database connections
     max-connections: 5
 ```
 
-For `database-url` formats, see [Database Connection URLs](#database-connection-urls).
+For `database-uri` formats, see [Database Connection URLs](#database-connection-urls).
 
 #### HTTP Storage (Remote Service)
 
@@ -602,13 +639,13 @@ store:
   # Discovery backend storage
   discover:
     type: "database"
-    database-url: "postgres://user:password@localhost:5432/switchgear"
+    database-uri: "postgres://{secret.POSTGRES_USERNAME}:{secret.POSTGRES_PASSWORD}@localhost:5432/switchgear"
     max-connections: 5
 
   # Offer storage (sharing same database)
   offer:
     type: "database"
-    database-url: "postgres://user:password@localhost:5432/switchgear"
+    database-uri: "postgres://{secret.POSTGRES_USERNAME}:{secret.POSTGRES_PASSWORD}@localhost:5432/switchgear"
     max-connections: 10
 ```
 
@@ -623,7 +660,7 @@ store:
   # Database storage for Offers
   offer:
     type: "database"
-    database-url: "sqlite:///var/lib/switchgear/offers.db?mode=rwc"
+    database-uri: "sqlite:///var/lib/switchgear/offers.db?mode=rwc"
     max-connections: 5
 ```
 
@@ -643,13 +680,13 @@ store:
   # Local database for Offers
   offer:
     type: "database"
-    database-url: "sqlite:///data/offers.db?mode=rwc"
+    database-uri: "sqlite:///data/offers.db?mode=rwc"
     max-connections: 10
 ```
 
 ### Database Connection URLs
 
-Both Discovery and Offer data stores have a `database-url` field to configure the database.
+Both Discovery and Offer data stores have a `database-uri` field to configure the database.
 
 ### Sqlite
 

migration/Cargo.toml

@@ -12,4 +12,4 @@ publish = true
 
 [dependencies]
 tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
-sea-orm-migration = { version = "1.1", default-features = false, features = ["cli", "sqlx-postgres", "sqlx-mysql", "sqlx-sqlite"] }
+sea-orm-migration = { version = "1", default-features = false, features = ["cli", "sqlx-postgres", "sqlx-mysql", "sqlx-sqlite"] }