Using Probot with Docker Secrets

[kjc17710]

Hello,

I am trying to get probot setup as a docker stack along with a proxy server to divvy up incoming requests to several instances of the app. The only way so far I have been able to get this to work is by having the .pem file locally available. I wanted to utilize docker secrets so I wouldn't need to keep the file available for anyone to just open. However, I have create the secrets using the files and then tried setting the PRIVATE_KEY or PRIVATE_KEY_PATH to the docker secrets path run/secrets/secretname and it doesn't seem to work. Based on the documentation it sounds like the PRIVATE_KEY_PATH must point to an actual .pem file, so that won't work. I thought the PRIVATE_KEY would but I see an error when probot goes to start up that says:

(node:25) UnhandledPromiseRejectionWarning: Error: The contents of PRIVATE_KEY could not be validated. Please check to ensure you have copied the contents of the .pem file correctly.

Has anyone been able to successfully use docker secrets to store the pem file contents and get probot to understand it?

[gr2m]

make sure that PRIVATE_KEY is set to the contents of the .pem file, with new lines replaced by \n

[kjc17710]

Thank you for your response! Here is what I tried based on your statement.

I updated the secret in docker to be just a long string with \n where the new lines were before and I DO NOT have the whole thing in quotes, just as it would be in a .pem file. Maybe I should try it with quotes?

I update the env variable and tried both:
PRIVATE_KEY=test_pem_key
and
PRIVATE_KEY=run/secrets/test_pem_key

Both of which resulted in the same error above.

I think possibly, the PRIVATE_KEY variable is taking those values literally and not pointing to their references? Any ideas on what else I can try?

[gr2m]

I think you will have to base64 encode the PRIVATE_KEY contents. Sorry it's been a while since I used that myself with Probot. See https://probot.github.io/docs/configuration/

[kjc17710]

The only way I was able to get secrets to work for the pem key was using the below links and script:

I created the secret from the pem file directly on the docker machine
Then utilized the script mentioned below in my compose file to grab the secret and put it into the environment variable

https://www.reddit.com/r/docker/comments/9k4tdi/using_docker_secrets_to_replace_environment_vars/e6yb8bt/?context=8&depth=9
https://medium.com/@adrian.gheorghe.dev/using-docker-secrets-in-your-environment-variables-7a0609659aab
https://gist.github.com/kevb/e0bef6549d0af12170b0beaeb736371d

It seems a little wonky, but it works and this way I don't have to include the pem file in my docker image.