From 60be4667a9b9a31ccc904b4996ae2ac7def0f942 Mon Sep 17 00:00:00 2001 From: Ben Luca Behring Date: Sun, 28 Jun 2026 11:20:22 +0200 Subject: [PATCH] feat: add admin password secret option Document IDM_ADMIN_PASSWORD_FILE usage via a compose override and Docker secret.\n\nRefs: opencloud-eu/opencloud-compose#306 --- .env.example | 2 ++ .gitignore | 3 +++ README.md | 11 ++++++++++- secrets/idm-admin-password.yml | 11 +++++++++++ 4 files changed, 26 insertions(+), 1 deletion(-) create mode 100644 secrets/idm-admin-password.yml diff --git a/.env.example b/.env.example index 81401e3e..6f4048e4 100644 --- a/.env.example +++ b/.env.example @@ -112,6 +112,8 @@ DEMO_USERS= # After the first initialization, the admin password can only be changed via the OpenCloud User Settings UI or by using the OpenCloud CLI. # Documentation: https://docs.opencloud.eu/docs/admin/resources/common-issues#-change-admin-password-set-in-env INITIAL_ADMIN_PASSWORD= +# To read the admin password from ./secrets/idm_admin_password instead, add +# secrets/idm-admin-password.yml to COMPOSE_FILE and leave INITIAL_ADMIN_PASSWORD empty. # Whether clients should check for updates. # Defaults to "true". CHECK_FOR_UPDATES= diff --git a/.gitignore b/.gitignore index fa204017..65ffbd66 100644 --- a/.gitignore +++ b/.gitignore @@ -17,3 +17,6 @@ # exclude the certificates config folder /config/traefik/dynamic/* !/config/traefik/dynamic/.gitkeep + +# exclude local secrets +/secrets/idm_admin_password diff --git a/README.md b/README.md index 5c7fa148..73545523 100644 --- a/README.md +++ b/README.md @@ -386,7 +386,7 @@ Key variables: |-------------------------------|-------------------------------------------------------|------------------------------| | `COMPOSE_FILE` | Colon-separated list of compose files to use | (commented out) | | `OC_DOMAIN` | OpenCloud domain | cloud.opencloud.test | -| `INITIAL_ADMIN_PASSWORD ` | OpenCloud password for the admin user | (no value) | +| `INITIAL_ADMIN_PASSWORD` | OpenCloud password for the admin user | (no value) | | `OC_DOCKER_TAG` | OpenCloud image tag | latest | | `OC_CONFIG_DIR` | Config directory path | (Docker volume) | | `OC_DATA_DIR` | Data directory path | (Docker volume) | @@ -427,6 +427,15 @@ For external LDAP servers, the admin password is managed by the LDAP server itse ``` INITIAL_ADMIN_PASSWORD=your-secure-password-here ``` +Alternatively, use Docker secrets: + +```bash +mkdir -p secrets +printf '%s' 'your-secure-password-here' > secrets/idm_admin_password +COMPOSE_FILE=docker-compose.yml:secrets/idm-admin-password.yml +``` + +Leave `INITIAL_ADMIN_PASSWORD` empty when using `IDM_ADMIN_PASSWORD_FILE`. For more details, see the [OpenCloud documentation](https://docs.opencloud.eu/docs/admin/resources/common-issues#-change-admin-password-set-in-env). diff --git a/secrets/idm-admin-password.yml b/secrets/idm-admin-password.yml new file mode 100644 index 00000000..937bf12b --- /dev/null +++ b/secrets/idm-admin-password.yml @@ -0,0 +1,11 @@ +--- +services: + opencloud: + environment: + IDM_ADMIN_PASSWORD_FILE: /run/secrets/idm_admin_password + secrets: + - idm_admin_password + +secrets: + idm_admin_password: + file: ./secrets/idm_admin_password