Admin CLI does not resolve Compose *_FILE secrets #112

New issue

Closed

opened 2026-08-24 08:36:56 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-08-24 08:36:56 +00:00

(Migrated from github.com)

Observed

In the deployed Compose container, STAR_AUTH_PEPPER_FILE=/run/secrets/auth_pepper and COUCHDB_PASSWORD_FILE=/run/secrets/couchdb_password are present and readable. The normal server entrypoint resolves those files before starting the service, but invoking the documented local admin command directly through docker exec fails:

star-server admin: STAR_AUTH_PEPPER or STAR_AUTH_PEPPER_FILE is required

The command only works after manually exporting the secret file contents into STAR_AUTH_PEPPER and COUCHDB_PASSWORD.

Expected

star-server admin should honor the same *_FILE secret configuration as the normal server startup, or the server-local administration documentation should provide an official safe wrapper for Compose deployments.

Reproduction

Start the Compose stack with the documented secret files.
Run docker exec <star-server> /bin/star-server admin user list.
Observe the missing-secret error despite the mounted files being readable.

No secret values are required to reproduce this.

Impact

Host-local user and API credential administration is not directly usable in the deployed container without manually handling secret material, which is error-prone for bootstrap and recovery operations.

Observed on application revision 8f6e50701081f0335c7552082dba5ff392b859e5.

## Observed In the deployed Compose container, `STAR_AUTH_PEPPER_FILE=/run/secrets/auth_pepper` and `COUCHDB_PASSWORD_FILE=/run/secrets/couchdb_password` are present and readable. The normal server entrypoint resolves those files before starting the service, but invoking the documented local admin command directly through `docker exec` fails: ```text star-server admin: STAR_AUTH_PEPPER or STAR_AUTH_PEPPER_FILE is required ``` The command only works after manually exporting the secret file contents into `STAR_AUTH_PEPPER` and `COUCHDB_PASSWORD`. ## Expected `star-server admin` should honor the same `*_FILE` secret configuration as the normal server startup, or the server-local administration documentation should provide an official safe wrapper for Compose deployments. ## Reproduction 1. Start the Compose stack with the documented secret files. 2. Run `docker exec <star-server> /bin/star-server admin user list`. 3. Observe the missing-secret error despite the mounted files being readable. No secret values are required to reproduce this. ## Impact Host-local user and API credential administration is not directly usable in the deployed container without manually handling secret material, which is error-prone for bootstrap and recovery operations. Observed on application revision `8f6e50701081f0335c7552082dba5ff392b859e5`.