Skip to content

Clarify how to set user own username/password in docker-compose for security #748

Closed
@Citronelol

Description

Feature description

Hi all,

Unless I am wrong today the only way to define a custom website username and password are overriding these values through the docker-compose files. See below for website configuration in docker-compose.prod.yml

    environment:
      ADMIN_USERNAME: "admin"
      ADMIN_PASSWORD: "password"
      ADMIN_EMAIL: "[email protected]"

This has some little disadvantages:

  • If I use both dev and prod environment I need to modify both docker-compose.prod.yml and docker-compose.dev.yml manually
  • If I try to deploy doccano in some CICD pipeline and need to override these values, I need to override the whole docker-compose file with a custom one, which is a bit overkill compared to using environment variables.
  • Not asking people to explicitly specify their own login and password values makes it easy for malicious individuals to guess secrets

What about suggesting users to define their own environment variables by creating and .env file ? (see variable substitution and using env variables in docker compose)

Procedure:

  • Website username and password variables (or more?) are stored in an .env file
  • docker-compose files use what's inside .env
  • We commit an .env.example file with default configuration
  • .env is added to .gitignore to make sure no one commits secrets
  • we add a step in README.md asking users to "copy the .env.example file in an .env file and eventually modify its content before launching docker-compose -f docker-compose.prod.yml up

I reckon this will make more complex the launching of doccano for new users (which is quite easy as of today!) and may increase errors if people do not follow or read the README.md correctly... there is maybe a tradeoff here, so happy to discuss and eventually contribute if needed.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

    Labels

    enhancementImprovement on existing feature

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions