Add example environment configuration and Docker Compose setup

- Introduced a new `.env.example` file to provide a template for environment variables used by the Scratchbox server. - Added a `docker-compose.example.yml` file to facilitate easy deployment of the Scratchbox service with Docker. - Updated `docker-entrypoint.sh` to enforce environment variable settings for server configuration. - Removed the generation of a config key file from the workflow, simplifying the configuration process. - Adjusted the README.md to reflect changes in configuration management and usage instructions.
2026-06-01 04:36:53 -05:00
parent f74e028227
commit bc9077660b
10 changed files with 672 additions and 112 deletions
@@ -5,6 +5,7 @@ import (
 	"encoding/base64"
 	"errors"
 	"fmt"
+	"io/fs"
 	"net/netip"
 	"os"
 	"path/filepath"
@@ -31,8 +32,7 @@ const (
 	defaultRawCacheMaxEntries        = 32
 	defaultDataDir                   = "./data"
 	defaultCleanupInterval           = "1m"
-	defaultStorageEncryptionKey      = "vVPlqMfKa8OtD3x0RKp4rVCJ4QoScf5mWdgfg4f+5GU="
-	defaultEncryptionKeyFile         = "config.key"
+	dataDirEncryptionKeyFilename     = "metadata.key"
 	defaultUIRateLimitEnabled        = false
 	defaultAPIReadRateLimitEnabled   = false
 	defaultAPIWriteRateLimitEnabled  = true
@@ -44,6 +44,7 @@ const (
 	defaultAPIWriteRateLimitBurst    = 10
 	maxDefaultTTLLimit               = 24 * time.Hour
 	minCleanupInterval               = 10 * time.Second
+	envPrefix                        = "SCRATCHBOX_"
 )

 type Config struct {
@@ -88,7 +89,6 @@ type LimitsConfig struct {
 type StorageConfig struct {
 	DataDir               string        `yaml:"data_dir" comment:"Directory where scratch files and metadata are stored."`
 	CleanupInterval       string        `yaml:"cleanup_interval" comment:"How often expired scratches are deleted (minimum 10s)."`
-	EncryptionKeyFile     string        `yaml:"encryption_key_file" comment:"Path to a file containing a base64-encoded 32-byte AES key for at-rest encryption. Relative paths are resolved from the config file directory."`
 	CleanupIntervalParsed time.Duration `yaml:"-"`
 	EncryptionKeyBytes    []byte        `yaml:"-"`
 }
@@ -121,10 +121,17 @@ func Load(path string) (Config, error) {
 			return Config{}, fmt.Errorf("parse config yaml: %w", err)
 		}
 	}
-	if err := cfg.loadEncryptionKey(path); err != nil {
+	if err := cfg.Validate(); err != nil {
 		return Config{}, err
 	}
+	return cfg, nil
+}

+func LoadFromEnv() (Config, error) {
+	cfg := defaults()
+	if err := cfg.applyEnvOverrides(envPrefix); err != nil {
+		return Config{}, err
+	}
 	if err := cfg.Validate(); err != nil {
 		return Config{}, err
 	}
@@ -157,10 +164,8 @@ func defaults() Config {
 			RawCacheMaxEntries: defaultRawCacheMaxEntries,
 		},
 		Storage: StorageConfig{
-			DataDir:            defaultDataDir,
-			CleanupInterval:    defaultCleanupInterval,
-			EncryptionKeyFile:  defaultEncryptionKeyFile,
-			EncryptionKeyBytes: mustDecodeDefaultEncryptionKey(),
+			DataDir:         defaultDataDir,
+			CleanupInterval: defaultCleanupInterval,
 		},
 		Security: SecurityConfig{
 			AllowedIPs: []string{
@@ -276,12 +281,14 @@ func (c *Config) Validate() error {
 	if err := ensureWritableDir(c.Storage.DataDir); err != nil {
 		return fmt.Errorf("storage.data_dir not writable: %w", err)
 	}
-	if strings.TrimSpace(c.Storage.EncryptionKeyFile) == "" {
-		return errors.New("storage.encryption_key_file is required")
+	encKey, err := ensureEncryptionKeyInDataDir(c.Storage.DataDir)
+	if err != nil {
+		return fmt.Errorf("storage encryption key setup failed: %w", err)
 	}
-	if len(c.Storage.EncryptionKeyBytes) != 32 {
-		return fmt.Errorf("storage.encryption_key_file must decode to 32 bytes, got %d", len(c.Storage.EncryptionKeyBytes))
+	if len(encKey) != 32 {
+		return fmt.Errorf("storage encryption key must decode to 32 bytes, got %d", len(encKey))
 	}
+	c.Storage.EncryptionKeyBytes = encKey

 	prefixes, err := parseAllowedPrefixes(c.Security.AllowedIPs)
 	if err != nil {
@@ -419,27 +426,56 @@ func GenerateEncryptionKey() (string, error) {
 	return base64.StdEncoding.EncodeToString(raw), nil
 }

-func (c *Config) loadEncryptionKey(configPath string) error {
-	if configPath == "" {
-		return nil
-	}
-	keyPath := strings.TrimSpace(c.Storage.EncryptionKeyFile)
-	if keyPath == "" {
-		return errors.New("storage.encryption_key_file is required")
-	}
-	if !filepath.IsAbs(keyPath) {
-		keyPath = filepath.Join(filepath.Dir(configPath), keyPath)
-	}
+func ensureEncryptionKeyInDataDir(dataDir string) ([]byte, error) {
+	keyPath := filepath.Join(dataDir, dataDirEncryptionKeyFilename)
 	keyRaw, err := os.ReadFile(keyPath)
 	if err != nil {
-		return fmt.Errorf("read storage.encryption_key_file %q: %w", keyPath, err)
+		if !errors.Is(err, os.ErrNotExist) {
+			return nil, fmt.Errorf("read %q: %w", keyPath, err)
+		}
+		hasFiles, checkErr := dataDirContainsFiles(dataDir, keyPath)
+		if checkErr != nil {
+			return nil, fmt.Errorf("scan %q for existing files: %w", dataDir, checkErr)
+		}
+		if hasFiles {
+			return nil, fmt.Errorf("refusing to generate missing %q because %q contains files; restore the original key file to avoid data corruption", dataDirEncryptionKeyFilename, dataDir)
+		}
+		generated, genErr := GenerateEncryptionKey()
+		if genErr != nil {
+			return nil, fmt.Errorf("generate key: %w", genErr)
+		}
+		if writeErr := os.WriteFile(keyPath, []byte(generated+"\n"), 0o600); writeErr != nil {
+			return nil, fmt.Errorf("write %q: %w", keyPath, writeErr)
+		}
+		return decodeEncryptionKey(generated)
 	}
 	encKey, err := decodeEncryptionKey(strings.TrimSpace(string(keyRaw)))
 	if err != nil {
-		return fmt.Errorf("storage.encryption_key_file invalid: %w", err)
+		return nil, fmt.Errorf("%q invalid: %w", keyPath, err)
 	}
-	c.Storage.EncryptionKeyBytes = encKey
-	return nil
+	return encKey, nil
+}
+
+func dataDirContainsFiles(dataDir string, keyPath string) (bool, error) {
+	keyPath = filepath.Clean(keyPath)
+	foundFile := false
+	err := filepath.WalkDir(dataDir, func(path string, d fs.DirEntry, walkErr error) error {
+		if walkErr != nil {
+			return walkErr
+		}
+		if d.IsDir() {
+			return nil
+		}
+		if filepath.Clean(path) == keyPath {
+			return nil
+		}
+		foundFile = true
+		return fs.SkipAll
+	})
+	if err != nil && !errors.Is(err, fs.SkipAll) {
+		return false, err
+	}
+	return foundFile, nil
 }

 func decodeEncryptionKey(raw string) ([]byte, error) {
@@ -456,10 +492,150 @@ func decodeEncryptionKey(raw string) ([]byte, error) {
 	return encKey, nil
 }

-func mustDecodeDefaultEncryptionKey() []byte {
-	encKey, err := decodeEncryptionKey(defaultStorageEncryptionKey)
-	if err != nil {
-		panic(fmt.Sprintf("invalid built-in encryption key: %v", err))
+func (c *Config) applyEnvOverrides(prefix string) error {
+	if err := applyStringEnv(prefix+"SERVER_LISTEN_ADDR", &c.Server.ListenAddr); err != nil {
+		return err
 	}
-	return encKey
+	if err := applyStringEnv(prefix+"SERVER_READ_HEADER_TIMEOUT", &c.Server.ReadHeaderTimeout); err != nil {
+		return err
+	}
+	if err := applyStringEnv(prefix+"SERVER_READ_TIMEOUT", &c.Server.ReadTimeout); err != nil {
+		return err
+	}
+	if err := applyStringEnv(prefix+"SERVER_WRITE_TIMEOUT", &c.Server.WriteTimeout); err != nil {
+		return err
+	}
+	if err := applyStringEnv(prefix+"SERVER_IDLE_TIMEOUT", &c.Server.IdleTimeout); err != nil {
+		return err
+	}
+	if err := applyIntEnv(prefix+"SERVER_MAX_HEADER_BYTES", &c.Server.MaxHeaderBytes); err != nil {
+		return err
+	}
+	if err := applyBoolEnv(prefix+"SERVER_ACCESS_LOG_ENABLED", &c.Server.AccessLog.Enabled); err != nil {
+		return err
+	}
+	if err := applyStringEnv(prefix+"SERVER_ACCESS_LOG_FILE_PATH", &c.Server.AccessLog.FilePath); err != nil {
+		return err
+	}
+	if err := applyStringEnv(prefix+"SERVER_ACCESS_LOG_MAX_SIZE", &c.Server.AccessLog.MaxSize); err != nil {
+		return err
+	}
+	if err := applyIntEnv(prefix+"SERVER_ACCESS_LOG_MAX_BACKUPS", &c.Server.AccessLog.MaxBackups); err != nil {
+		return err
+	}
+
+	if err := applyStringEnv(prefix+"LIMITS_MAX_UPLOAD_SIZE", &c.Limits.MaxUploadSize); err != nil {
+		return err
+	}
+	if err := applyStringEnv(prefix+"LIMITS_DEFAULT_TTL", &c.Limits.DefaultTTL); err != nil {
+		return err
+	}
+	if err := applyStringEnv(prefix+"LIMITS_RAW_CACHE_MAX_SIZE", &c.Limits.RawCacheMaxSize); err != nil {
+		return err
+	}
+	if err := applyIntEnv(prefix+"LIMITS_RAW_CACHE_MAX_ENTRIES", &c.Limits.RawCacheMaxEntries); err != nil {
+		return err
+	}
+
+	if err := applyStringEnv(prefix+"STORAGE_DATA_DIR", &c.Storage.DataDir); err != nil {
+		return err
+	}
+	if err := applyStringEnv(prefix+"STORAGE_CLEANUP_INTERVAL", &c.Storage.CleanupInterval); err != nil {
+		return err
+	}
+
+	applyListEnv(prefix+"SECURITY_ALLOWED_IPS", &c.Security.AllowedIPs)
+	if err := applyBoolEnv(prefix+"SECURITY_TRUST_PROXY_HEADERS", &c.Security.TrustProxyHeaders); err != nil {
+		return err
+	}
+	applyListEnv(prefix+"SECURITY_TRUSTED_PROXY_IPS", &c.Security.TrustedProxyIPs)
+
+	if err := applyBoolEnv(prefix+"SECURITY_RATE_LIMIT_UI_ENABLED", &c.Security.RateLimitUI.Enabled); err != nil {
+		return err
+	}
+	if err := applyIntEnv(prefix+"SECURITY_RATE_LIMIT_UI_REQUESTS_PER_MINUTE", &c.Security.RateLimitUI.RequestsPerMinute); err != nil {
+		return err
+	}
+	if err := applyIntEnv(prefix+"SECURITY_RATE_LIMIT_UI_BURST", &c.Security.RateLimitUI.Burst); err != nil {
+		return err
+	}
+
+	if err := applyBoolEnv(prefix+"SECURITY_RATE_LIMIT_API_READ_ENABLED", &c.Security.RateLimitAPIRead.Enabled); err != nil {
+		return err
+	}
+	if err := applyIntEnv(prefix+"SECURITY_RATE_LIMIT_API_READ_REQUESTS_PER_MINUTE", &c.Security.RateLimitAPIRead.RequestsPerMinute); err != nil {
+		return err
+	}
+	if err := applyIntEnv(prefix+"SECURITY_RATE_LIMIT_API_READ_BURST", &c.Security.RateLimitAPIRead.Burst); err != nil {
+		return err
+	}
+
+	if err := applyBoolEnv(prefix+"SECURITY_RATE_LIMIT_API_WRITE_ENABLED", &c.Security.RateLimitAPIWrite.Enabled); err != nil {
+		return err
+	}
+	if err := applyIntEnv(prefix+"SECURITY_RATE_LIMIT_API_WRITE_REQUESTS_PER_MINUTE", &c.Security.RateLimitAPIWrite.RequestsPerMinute); err != nil {
+		return err
+	}
+	if err := applyIntEnv(prefix+"SECURITY_RATE_LIMIT_API_WRITE_BURST", &c.Security.RateLimitAPIWrite.Burst); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func applyStringEnv(name string, target *string) error {
+	value, ok := os.LookupEnv(name)
+	if !ok {
+		return nil
+	}
+	*target = strings.TrimSpace(value)
+	return nil
+}
+
+func applyBoolEnv(name string, target *bool) error {
+	value, ok := os.LookupEnv(name)
+	if !ok {
+		return nil
+	}
+	parsed, err := strconv.ParseBool(strings.TrimSpace(value))
+	if err != nil {
+		return fmt.Errorf("%s invalid bool: %w", name, err)
+	}
+	*target = parsed
+	return nil
+}
+
+func applyIntEnv(name string, target *int) error {
+	value, ok := os.LookupEnv(name)
+	if !ok {
+		return nil
+	}
+	parsed, err := strconv.Atoi(strings.TrimSpace(value))
+	if err != nil {
+		return fmt.Errorf("%s invalid int: %w", name, err)
+	}
+	*target = parsed
+	return nil
+}
+
+func applyListEnv(name string, target *[]string) {
+	value, ok := os.LookupEnv(name)
+	if !ok {
+		return
+	}
+	if strings.TrimSpace(value) == "" {
+		*target = nil
+		return
+	}
+
+	parts := strings.Split(value, ",")
+	out := make([]string, 0, len(parts))
+	for _, part := range parts {
+		item := strings.TrimSpace(part)
+		if item == "" {
+			continue
+		}
+		out = append(out, item)
+	}
+	*target = out
 }