How to store docker secrets for Flame?
reddit / selfhosted

----------------------------------------------------------------------
timlwsk · 2023-10-09 22:20

Heya,

I'm trying to set up [Flame](https://github.com/pawelmalak/flame) for
my Docker Network, but I don't understand how to use secrets properly.

The docker compose from the documentation shows:

    version: '3.6'

    services:
      flame:
        image: pawelmalak/flame
        container_name: flame
        volumes:
          - /path/to/host/data:/app/data
          - /var/run/docker.sock:/var/run/docker.sock # optional but
required for Docker integration
        ports:
          - 5005:5005
        secrets:
          - password # optional but required for (1)
        environment:
          - PASSWORD=flame_password
          - PASSWORD_FILE=/run/secrets/password # optional but
required for (1)
        restart: unless-stopped

    # optional but required for Docker secrets (1)
    secrets:
      password:
        file: /path/to/secrets/password

all my persistent volumes are stored in /home/pi/docker/CONTAINERNAME.

1. Where would I need to store my secrets file?
2. What contents should be in there?
3. What is the benefit of doing this instead of pasting the password
as a string?

----------------------------------------------------------------------
thekrautboy · 2023-10-09 22:32

Have you tried to look at the Docker compose documentation?

https://docs.docker.com/compose/use-secrets/

> Where would I need to store my secrets file?

`file: /path/to/secrets/password`

> What contents should be in there?

The password?!

> What is the benefit of doing this instead of pasting the password as
a string?

It allows you to store your password separately from your compose file
in another file. As a result you can easily backup/share your compose
without having any confidential info inside it. And you can protect
the secrets file with typical linux user permissions so that only the
Docker user can access it.

Btw in Flame, this is completely optional. You can simply provide your
password as string to the environment variable `PASSWORD` and remove
everything about secrets. Exactly as the Flame comments explain.

----------------------------------------------------------------------
timlwsk · 2023-10-09 22:37

Sorry, I have worded my questions badly.

~~Where would I need to store my secrets file?~~ What would be the
best place to store my secrets file? Alongside the persistent data, or
in a different/seperate folder?

~~The password?!~~ Just that? No formatting, nothing?

Thank you very much for the explanation on secrets. I understand the
flame documentation correctly, that I need to provide the docker
(user?) password, in order to get the integration to work, right?

----------------------------------------------------------------------
thekrautboy · 2023-10-09 22:46

> Alongside the persistent data, or in a different/seperate folder?

Thats completely up to you. There is no "best" place. If you use linux
user permissions for the file, then from security alone, it doesnt
matter if its stored with the rest of the containers data or somewhere
else. If you dont feel confident enough to set those permissions
properly, then maybe storing the file somewhere completely different
is better for you.

> Just that? No formatting, nothing?

Just that. Exactly as the Docker compose documentation explains.

> I understand the flame documentation correctly, that I need to
provide the docker (user?) password, in order to get the integration
to work, right?

What?! No absolutely not.

https://github.com/pawelmalak/flame#docker-integration

It explains the steps for the Docker integration right there. Nothing
at all about the Docker user password is mentioned.

Seriously, why do you not read the documentations and follow them?
Both for Docker compose and for Flame itself?

And again, this belongs in /r/Docker but over there i would tell you
the same. Every answer to your questions is already right there in
front of you.

----------------------------------------------------------------------
timlwsk · 2023-10-09 23:09

I appreciate your help. I will mark this as solved and have a deeper
look at the docs tomorrow.