Allow the use of secrets

README.md

@@ -189,7 +189,7 @@ A user has the following properties:
 Permissions can be `*` or `read`. We are planning to support a more fine-grained
 control over permissions in future releases of the add-on.
 
-**Note**: _These options support secrets, e.g., `!secret red_password`._
+**Note**: _These options (except for `permissions`) support secrets, e.g., `!secret red_password`._
 
 ### Option: `http_node`
 

node-red/package.json

@@ -10,6 +10,7 @@
     },
     "dependencies": {
         "bcryptjs": "2.4.3",
+        "js-yaml": "3.12.0",
         "node-red": "0.19.1",
         "node-red-contrib-actionflows": "2.0.0",
         "node-red-contrib-alexa-home-skill": "0.1.17",

node-red/rootfs/etc/node-red/config.js

@@ -2,6 +2,46 @@ const config = require('/config/node-red/settings.js');
 const fs = require('fs');
 const options = JSON.parse(fs.readFileSync('/data/options.json', 'utf8'));
 const bcrypt = require('bcryptjs');
+const yaml = require('js-yaml');
+
+/**
+ * Gets a configuration option value by getting it from secrets.yaml
+ *
+ * @param {string} Value
+ *   Configuration value to resolve
+ *
+ * @return
+ *   Returns the converted configuration value
+ */
+function getSecret(value) {
+    if(!value.startsWith('!secret ')) {
+        // This is not a secret
+        return value
+    }
+
+    secret = value.substring(8)
+
+    if (!fs.existsSync('/config')) {
+        console.log('This add-on does not support secrets!');
+        process.exit(1);
+        return false
+    }
+    if (!fs.existsSync('/config/secrets.yaml')) {
+        console.log(`A secret ${secret} was requested, but could not find a secrets.yaml!`);
+        process.exit(1);
+        return false
+    }
+
+    secrets = yaml.load(fs.readFileSync('/config/secrets.yaml', 'utf8'));
+
+    if (!(secret in secrets)) {
+        console.log(`Secret ${secret} is not in the secrets.yaml file`);
+        process.exit(1);
+        return false
+    }
+
+    return secrets[secret];
+}
 
 // Sane and required defaults for the add-on
 config.uiHost = '0.0.0.0';
@@ -12,13 +52,13 @@ config.nodesDir = '/config/node-red/nodes';
 
 // Several settings
 config.uiPort = options.port;
-config.credentialSecret = options.credential_secret;
+config.credentialSecret = getSecret(options.credential_secret);
 
 // Set SSL if enabled
 if (options.ssl === true) {
     config.https = {
-        key: fs.readFileSync(`/ssl/${options.keyfile}`),
-        cert: fs.readFileSync(`/ssl/${options.certfile}`),
+        key: fs.readFileSync(`/ssl/${getSecret(options.keyfile)}`),
+        cert: fs.readFileSync(`/ssl/${getSecret(options.certfile)}`),
     };
     config.requireHttps = options.require_ssl;
 }
@@ -32,26 +72,26 @@ if (options.users.length !== 0) {
 
     options.users.forEach((user, index) => {
         config.adminAuth.users.push({
-            username: user.username,
-            password: bcrypt.hashSync(user.password),
-            permissions: user.permissions,
+            username: getSecret(user.username),
+            password: bcrypt.hashSync(getSecret(user.password)),
+            permissions: getSecret(user.permissions),
         });
     });
 }
 
 // Secure HTTP node
 if (options.http_node.username) {
     config.httpNodeAuth = {
-        user: options.http_node.username,
-        pass: bcrypt.hashSync(options.http_node.password),
+        user: getSecret(options.http_node.username),
+        pass: bcrypt.hashSync(getSecret(options.http_node.password)),
     };
 }
 
 // Secure static HTTP
 if (options.http_static.username) {
     config.httpStaticAuth = {
-        user: options.http_static.username,
-        pass: bcrypt.hashSync(options.http_static.password),
+        user: getSecret(options.http_static.username),
+        pass: bcrypt.hashSync(getSecret(options.http_static.password)),
     }
 }