42 lines
2.2 KiB
Markdown
42 lines
2.2 KiB
Markdown
---
|
|
tags:
|
|
- GIT
|
|
- CI/CD
|
|
- CI-CD
|
|
---
|
|
🔒 Part 1: Inject Gitea Secrets into Compose Files Safely
|
|
|
|
Hardcoding sensitive data like passwords, API keys, or database credentials into your Git repository is a major security risk. Instead, you should store them in Gitea and pass them dynamically at runtime. [[1](https://www.softrams.com/post/deploying-kong-gateway-in-db-less-mode-on-kubernetes), [2](https://medium.com/@saumya07013/safely-managing-secrets-in-containers-best-practices-and-strategies-1b71e49b1525), [3](https://www.howtogeek.com/devops/how-to-protect-sensitive-secrets-and-credentials-in-your-git-repository/), [4](https://glmdev.medium.com/code-freedom-with-gitea-drone-ci-part-i-4b9dfbce1514)]
|
|
|
|
1. Add Secrets to Gitea
|
|
|
|
2. Go to your repository in Gitea.
|
|
3. Navigate to **Settings** ➡️ **Actions** ➡️ **Secrets**.
|
|
4. Click **貯/Add Secret**.
|
|
5. Add your variables (e.g., Key: `MYSQL_PASSWORD`, Value: `super_secret_password_123`). [[1](https://blog.devgenius.io/setting-up-a-simple-ci-cd-with-django-gitea-jenkins-and-of-course-docker-ab883972efb5), [2](https://testautomationu.applitools.com/observability-for-test-automation/chapter11.html), [3](https://medium.com/google-developer-experts/how-to-store-sensitive-data-on-gcp-d96e4e545224)]
|
|
|
|
6. Update Your `docker-compose.yml`
|
|
|
|
Configure your Compose file to look for standard environment variables. Do not include default values here.
|
|
|
|
services:
|
|
database:
|
|
image: mysql:8.0
|
|
environment:
|
|
- MYSQL_ROOT_PASSWORD=${DB_ROOT_PASSWORD}
|
|
- MYSQL_PASSWORD=${DB_PASSWORD}
|
|
|
|
3. Update Your Gitea Workflow File
|
|
|
|
You can map Gitea Secrets into an environment block right inside your workflow step. When `docker compose` runs, it will read those variables from the runner's system environment and inject them into the container definition. [[1](https://www.dataquest.io/blog/intro-to-docker-compose/)]
|
|
|
|
- name: Verify Compose File Validity
|
|
env:
|
|
# Map Gitea Secrets to the environment variables expected by your compose file
|
|
DB_ROOT_PASSWORD: ${{ secrets.MYSQL_ROOT_PASSWORD }}
|
|
DB_PASSWORD: ${{ secrets.MYSQL_PASSWORD }}
|
|
run: |
|
|
echo "Injecting secrets and testing configuration..."
|
|
docker compose config
|
|
|