2.2 KiB
tags
| tags | |||
|---|---|---|---|
|
🔒 Part 1: Inject Gitea Secrets into Compose Files Safely
Hardcoding sensitive data like passwords, API keys, or database credentials into your Git repository is a major security risk. Instead, you should store them in Gitea and pass them dynamically at runtime. [1, 2, 3, 4]
-
Add Secrets to Gitea
-
Go to your repository in Gitea.
-
Navigate to Settings ➡️ Actions ➡️ Secrets.
-
Click 貯/Add Secret.
-
Add your variables (e.g., Key:
MYSQL_PASSWORD, Value:super_secret_password_123). [1, 2, 3] -
Update Your
docker-compose.yml
Configure your Compose file to look for standard environment variables. Do not include default values here.
services:
database:
image: mysql:8.0
environment:
- MYSQL_ROOT_PASSWORD=${DB_ROOT_PASSWORD}
- MYSQL_PASSWORD=${DB_PASSWORD}
- Update Your Gitea Workflow File
You can map Gitea Secrets into an environment block right inside your workflow step. When docker compose runs, it will read those variables from the runner's system environment and inject them into the container definition. [1]
- name: Verify Compose File Validity
env:
# Map Gitea Secrets to the environment variables expected by your compose file
DB_ROOT_PASSWORD: ${{ secrets.MYSQL_ROOT_PASSWORD }}
DB_PASSWORD: ${{ secrets.MYSQL_PASSWORD }}
run: |
echo "Injecting secrets and testing configuration..."
docker compose config