Using docker secrets in Swarm

[urbaman]

Hi,

Trying to install as a service in a Swarm cluster, I'm not able to use ENV vars, but could use docker secrets.
It seems that POSTGRES_PASSWORD does not have an equivament POSTGRES_PASSWORD_FILE to read from a secret.

Is there a better way to solve this?

Thanks.

networks:
  databases:
    external: true

secrets:
  POSTGRES_PASSWORD:
    file: .POSTGRES_PASSWORD

services:
  pg17-v043:
    image: tensorchord/vchord-postgres:pg17-v0.4.3
    networks:
      - databases
    secrets:
      - POSTGRES_PASSWORD
    environment:
      - POSTGRES_PASSWORD_FILE:/run/secrets/POSTGRES_PASSWORD
    volumes:
      - /SwarmVolumes/data/postgresql:/var/lib/postgresql/data
      - /SwarmVolumes/configs/postgresql:/etc/postgresql
    deploy:
      mode: replicated
      replicas: 1

datagases_pg17-v043.1.8mv6129a1nrt@docker3    | Error: Database is uninitialized and superuser password is not specified.
datagases_pg17-v043.1.8mv6129a1nrt@docker3    |        You must specify POSTGRES_PASSWORD to a non-empty value for the
datagases_pg17-v043.1.8mv6129a1nrt@docker3    |        superuser. For example, "-e POSTGRES_PASSWORD=password" on "docker run".
datagases_pg17-v043.1.8mv6129a1nrt@docker3    |
datagases_pg17-v043.1.8mv6129a1nrt@docker3    |        You may also use "POSTGRES_HOST_AUTH_METHOD=trust" to allow all
datagases_pg17-v043.1.8mv6129a1nrt@docker3    |        connections without a password. This is *not* recommended.
datagases_pg17-v043.1.8mv6129a1nrt@docker3    |
datagases_pg17-v043.1.8mv6129a1nrt@docker3    |        See PostgreSQL documentation about "trust":
datagases_pg17-v043.1.8mv6129a1nrt@docker3    |        https://www.postgresql.org/docs/current/auth-trust.html

Thank you very much.

[xieydd]

Sorry, the reply is late. In YAML, a hyphen - represents an item in a list. So, you are actually defining a list that contains only one string, the content of which is "POSTGRES_PASSWORD_FILE:/run/secrets/POSTGRES_PASSWORD". The following YAML should be working.

networks:
  databases:
    external: true

secrets:
  POSTGRES_PASSWORD:
    file: .POSTGRES_PASSWORD

services:
  pg17-v043:
    image: tensorchord/vchord-postgres:pg17-v0.4.3
    networks:
      - databases
    secrets:
      - POSTGRES_PASSWORD
    environment:
      POSTGRES_PASSWORD_FILE: /run/secrets/POSTGRES_PASSWORD
    volumes:
      - /SwarmVolumes/data/postgresql:/var/lib/postgresql/data
      - /SwarmVolumes/configs/postgresql:/etc/postgresql
    deploy:
      mode: replicated
      replicas: 1