Consider env interpolation for the config.yml file

[f1yn]

Hey there!

I found this project today while deprecating some old processes I had for iCal in Zoho, and found this project - which solves 90% of every problem I've been having trying to consolidate calendars.

However, I have a strict network provisioning and deployment setup at home, where any sensitive value (like iCal links) need to be consumed via docker or podman secrets (and then injected into the env). I'd rather parition values that might change away from the source code.

The current setup you've made seems to be statically parsing the config file - which won't work for my needs. I've considered going to long way around and having the /config.yml file assembled in a Docker iamge - but that feels overkill.

It might be easier for you to have the env interpolated into the config.yml as it's read - but wanted to know if this is something you'd be willing to solve? I can also give it a shot, but I haven't picked up any go yet.

[f1yn]

I did some digging, and it looks like the source for the yaml parser has been deprecated a while ago: https://pkg.go.dev/gopkg.in/yaml.v3#pkg-overview -> https://github.com/go-yaml/yaml

[Jojodicus]

Hi,

thanks for using Calunite, I'm always happy to see that! Let's get you the rest of the way to 100% satisfaction then

Regarding the parser lib, you are absolutely correct. I didn't do my research properly when starting this project. Back then it was still maintained, or at least classified so. I'll move this to a separate issue though to keep tracking clean.

For the configuration, I also understand that you don't want these to reside on your servers. But from my understanding, you can already do that just by using the tools Docker provides and passing the configuration as a secret:

services:
  calunite:
    image: jojodicus/calunite
    container_name: calunite
    restart: unless-stopped
    secrets:
      - calunite-config
    ports:
      - 8080:8080
    environment:
      CFG_PATH: /run/secrets/calunite-config

secrets:
  calunite-config:
    file: testdata/config.yml
    # external: true # <- use this instead when providing via `docker secret` in a swarm

Docker supports secrets both as files and as environment variables. Using the latter for yaml-based configurations would be very cumbersome.
You don't gain any extra security if you have a configuration as an environment variable. Calunite uses distroless containers, so apart from itself, there are no other binaries (including shells) in the container. And once you have filesystem access or ACE, an attacker can ptrace to their liking anyway.

Also, as of version 1.4, hot-reloading of a config is supported 🥳 this also works for file-based secrets, should even work in a swarm and distribute automatically (though i have only tested with a local swarm for now)

Is this what you wanted, or am I missing something?