No, like a path to a file containing the secret/passphrase that the program can then read it from. I am not a fan of putting secrets directly into environment variables.
Environment variables are prone to leak or be passed to child processes when it is not desired. But if they are just a file path/pointer to where the secret is, that is mitigated somewhat as one then would still need access to that file.
Comments
Very interesting. Like the idea of using http, redis, or even PostgreSQL clients.
Is there a way to provide the auth password via an envar instead of a command line arg?
That's the only way right now. The other ways I'm considering is with an environment variable and/or acl.
May I suggest the ability to specific a path to a file that it is then read from.
Like an ACL file?
No, like a path to a file containing the secret/passphrase that the program can then read it from. I am not a fan of putting secrets directly into environment variables.
Environment variables are prone to leak or be passed to child processes when it is not desired. But if they are just a file path/pointer to where the secret is, that is mitigated somewhat as one then would still need access to that file.