# HG changeset patch
# User Kim Alvefur <zash@zash.se>
# Date 1737037294 -3600
# Node ID 2db7b3b65363477e36f3e9554d86fd741659bf31
# Parent  ac60c21015c7e5528bca5054bb291e428a7b9b0e
core.configmanager: Add function for getting secrets from separate files

Idea is to enable easily retrieving of secret values from files outside
of the config, e.g. via the method used by systemd credentials.

CREDENTIALS_DIRECTORY is expected to be set by the process manager
invoking Prosody, so being unset and unavailable from prosodyctl is
going to be normal and a warning is reported in that case. Care will
have to be taken to make it clear that prosodyctl check will not work
with such values. An error is thrown if the directory is unavailable
when running under Prosody.

diff -r ac60c21015c7 -r 2db7b3b65363 CHANGES
--- a/CHANGES	Thu Jan 16 15:05:00 2025 +0100
+++ b/CHANGES	Thu Jan 16 15:21:34 2025 +0100
@@ -60,7 +60,7 @@
 
 - The configuration file now supports referring and appending to options previously set
 - Direct usage of the Lua API in the config file is deprecated, but can now be accessed via Lua.* instead
-- Convenience functions for reading values from files
+- Convenience functions for reading values from files, with variant meant for credentials or secrets
 
 ## Changes
 
diff -r ac60c21015c7 -r 2db7b3b65363 core/configmanager.lua
--- a/core/configmanager.lua	Thu Jan 16 15:05:00 2025 +0100
+++ b/core/configmanager.lua	Thu Jan 16 15:21:34 2025 +0100
@@ -198,6 +198,7 @@
 			FileContents = true,
 			FileLine = true,
 			FileLines = true,
+			Secret = true,
 			Include = true, include = true, RunScript = true }, {
 				__index = function (_, k)
 					if k:match("^ENV_") then
@@ -359,6 +360,19 @@
 		env.FileLine = filereader(config_path, "*l");
 		env.FileLines = linereader(config_path);
 
+		if _G.prosody.paths.secrets then
+			env.Secret = filereader(_G.prosody.paths.secrets, "*a");
+		elseif _G.prosody.process_type == "prosody" then
+			env.Secret = function() error("Secret() requires the $CREDENTIALS_DIRECTORY environment variable to be set", 2) end
+		else
+			env.Secret = function()
+				t_insert(warnings, ("%s:%d: Secret() requires the $CREDENTIALS_DIRECTORY environment variable to be set")
+						:format(config_file, get_line_number(config_file)));
+				return nil;
+			end
+
+		end
+
 		local chunk, err = envload(data, "@"..config_file, env);
 
 		if not chunk then
diff -r ac60c21015c7 -r 2db7b3b65363 util/startup.lua
--- a/util/startup.lua	Thu Jan 16 15:05:00 2025 +0100
+++ b/util/startup.lua	Thu Jan 16 15:21:34 2025 +0100
@@ -266,8 +266,13 @@
 	full_sessions = prosody.full_sessions;
 	hosts = prosody.hosts;
 
-	prosody.paths = { source = CFG_SOURCEDIR, config = CFG_CONFIGDIR or ".",
-	                  plugins = CFG_PLUGINDIR or "plugins", data = "data" };
+	prosody.paths = {
+		source = CFG_SOURCEDIR;
+		config = CFG_CONFIGDIR or ".";
+		plugins = CFG_PLUGINDIR or "plugins";
+		data = "data";
+		secrets = os.getenv("CREDENTIALS_DIRECTORY");
+	};
 
 	prosody.arg = _G.arg;