Read ID & SECRET from files #27

New Issue

GiteaMirror · 2025-11-19T07:12:19-06:00

GiteaMirror commented

2025-11-19 07:12:19 -06:00

Originally created by @thalin on GitHub (May 22, 2025).

Originally assigned to: @oschwartz10612 on GitHub.

A standard security practice is to pass secret values in files so that they aren't exposed via /proc and/or ps. It would be great if you could specify --id-file and --secret-file to pass along these values as files instead of directly on the command line.

An additional bonus would be being able to set _FILE environment variables for these as well, to match the existing environment variables from which newt reads secrets now.

Originally created by @thalin on GitHub (May 22, 2025). Originally assigned to: @oschwartz10612 on GitHub. A standard security practice is to pass secret values in files so that they aren't exposed via /proc and/or ps. It would be great if you could specify --id-file and --secret-file to pass along these values as files instead of directly on the command line. An additional bonus would be being able to set _FILE environment variables for these as well, to match the existing environment variables from which newt reads secrets now.

GiteaMirror added the enhancement label 2025-11-19 07:12:19 -06:00

GiteaMirror closed this issue

2025-11-19 07:12:20 -06:00

GiteaMirror commented

2025-11-19 07:12:20 -06:00

@oschwartz10612 commented on GitHub (May 22, 2025):

The id and secret are actually saved in the files at the following locations, depending on your operating system after you do a initial connection with the values. This should be documented better and we should also add a way to control the files so I will leave this open.

macOS: ~/Library/Application Support/newt-client
Windows: %APPDATA%\newt-client
Linux (and others): ~/.config/newt-client

@oschwartz10612 commented on GitHub (May 22, 2025): The id and secret are actually saved in the files at the following locations, depending on your operating system after you do a initial connection with the values. This should be documented better and we should also add a way to control the files so I will leave this open. macOS: ~/Library/Application Support/newt-client Windows: %APPDATA%\newt-client Linux (and others): ~/.config/newt-client

GiteaMirror commented

2025-11-19 07:12:20 -06:00

@wolrah commented on GitHub (Jul 11, 2025):

I'd like to also see a standard system-wide location like /etc/ used instead of /root/.config/ when running as a service.

@wolrah commented on GitHub (Jul 11, 2025): I'd like to also see a standard system-wide location like /etc/ used instead of /root/.config/ when running as a service.

GiteaMirror commented

2025-11-19 07:12:20 -06:00

@vworldat commented on GitHub (Aug 16, 2025):

I'd also really prefer a NEWT_SECRET_FILE env option as recommended in the docker compose docs: https://docs.docker.com/compose/how-tos/use-secrets/

@vworldat commented on GitHub (Aug 16, 2025): I'd also really prefer a `NEWT_SECRET_FILE` env option as recommended in the docker compose docs: https://docs.docker.com/compose/how-tos/use-secrets/

GiteaMirror commented

2025-11-19 07:12:21 -06:00

@oschwartz10612 commented on GitHub (Aug 23, 2025):

This is actually currently possible with the latest newt! It already
looks for a config file:

$ cat ~/.config/newt-client/config.json
{
   "id": "spmzu8rbpzj1qq6",
   "secret": "f6v61mjutw233245kkydbw3fjo227zl60a2tsf5psw9r25hgae3",
   "endpoint": "https://pangolin.fossorial.io",
   "tlsClientCert": ""
}

... and that file can be changed with the CONFIG_FILE env var found at
websocket/config.go. Need to document this better...

@oschwartz10612 commented on GitHub (Aug 23, 2025): This is actually currently possible with the latest newt! It already looks for a config file: ``` $ cat ~/.config/newt-client/config.json { "id": "spmzu8rbpzj1qq6", "secret": "f6v61mjutw233245kkydbw3fjo227zl60a2tsf5psw9r25hgae3", "endpoint": "https://pangolin.fossorial.io", "tlsClientCert": "" } ``` ... and that file can be changed with the CONFIG_FILE env var found at websocket/config.go. Need to document this better...

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/newt#27