feat: add admin password secret option

.env.example

@@ -112,6 +112,8 @@ DEMO_USERS=
 # After the first initialization, the admin password can only be changed via the OpenCloud User Settings UI or by using the OpenCloud CLI.
 # Documentation: https://docs.opencloud.eu/docs/admin/resources/common-issues#-change-admin-password-set-in-env
 INITIAL_ADMIN_PASSWORD=
+# To read the admin password from ./secrets/idm_admin_password instead, add
+# secrets/idm-admin-password.yml to COMPOSE_FILE and leave INITIAL_ADMIN_PASSWORD empty.
 # Whether clients should check for updates.
 # Defaults to "true".
 CHECK_FOR_UPDATES=

.gitignore

@@ -17,3 +17,6 @@
 # exclude the certificates config folder
 /config/traefik/dynamic/*
 !/config/traefik/dynamic/.gitkeep
+
+# exclude local secrets
+/secrets/idm_admin_password

README.md

@@ -386,7 +386,7 @@ Key variables:
 |-------------------------------|-------------------------------------------------------|------------------------------|
 | `COMPOSE_FILE`                | Colon-separated list of compose files to use          | (commented out)              |
 | `OC_DOMAIN`                   | OpenCloud domain                                      | cloud.opencloud.test         |
-| `INITIAL_ADMIN_PASSWORD `     | OpenCloud password for the admin user                 | (no value)                   |
+| `INITIAL_ADMIN_PASSWORD`      | OpenCloud password for the admin user                 | (no value)                   |
 | `OC_DOCKER_TAG`               | OpenCloud image tag                                   | latest                       |
 | `OC_CONFIG_DIR`               | Config directory path                                 | (Docker volume)              |
 | `OC_DATA_DIR`                 | Data directory path                                   | (Docker volume)              |
@@ -427,6 +427,15 @@ For external LDAP servers, the admin password is managed by the LDAP server itse
 ```
 INITIAL_ADMIN_PASSWORD=your-secure-password-here
 ```
+Alternatively, use Docker secrets:
+
+```bash
+mkdir -p secrets
+printf '%s' 'your-secure-password-here' > secrets/idm_admin_password
+COMPOSE_FILE=docker-compose.yml:secrets/idm-admin-password.yml
+```
+
+Leave `INITIAL_ADMIN_PASSWORD` empty when using `IDM_ADMIN_PASSWORD_FILE`.
 
 For more details, see the [OpenCloud documentation](https://docs.opencloud.eu/docs/admin/resources/common-issues#-change-admin-password-set-in-env).
 

secrets/idm-admin-password.yml

@@ -0,0 +1,11 @@
+---
+services:
+  opencloud:
+    environment:
+      IDM_ADMIN_PASSWORD_FILE: /run/secrets/idm_admin_password
+    secrets:
+      - idm_admin_password
+
+secrets:
+  idm_admin_password:
+    file: ./secrets/idm_admin_password