Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[enhancement] Allow usage of environment variables in config file #1791

Closed
Lorilandly opened this issue Mar 14, 2023 · 1 comment
Closed

Comments

@Lorilandly
Copy link

TLDR
systemd提供了专门用于传递证书给程序(程序可能本来没有权限访问证书)的一个途径LoadCredencial=,比手动修改权限的方式安全并简洁。然而,systemd的这个功能需要使用环境变量来传递证书,但xray的配置文件并不支持环境变量。我的建议是可以在配置文件中添加对环境变量的支持,或直接读取相对应的环境变量。例如:

"certificates": [
    {
        "certificateFile": "$CREDENTIALS_DIRECTORY/fullchain",
        "keyFile": "$CREDENTIALS_DIRECTORY/privkey"
    }
]

正文
理想状态下,ssl证书只应该能够被root用户访问,而xray不应该拥有太多权限。xray如想使用ssl证书(需root权限),需要修改证书权限或者用nobody用户chown证书(source)。然而,这些方法或是存在安全隐患,或是不优雅(需添加新用户)。

systemd提供了一套完整的方法使得在不修改权限的情况下让进程能够访问特定的read protected files,例如/var/log/var/cache、证书等,同时保证它不能访问任何它不应该访问的文件(参考)。但是systemd传证书的方式有点小尴尬,需要用到环境变量$CREDENTIALS_DIRECTORY。这是因为传递的这个路径是动态的,不一定是在一个能提前得知的位置。

如果现在就想使用systemd来传递证书,把环境变量写在配置里的话,需要在systemd里这样启动xray

ExecStart=/bin/sh -c '/usr/bin/envsubst < /usr/local/etc/xray/config.json | /usr/local/bin/xray'

显而易见的不是很好看

所以如果config能支持环境变量那是再好不过了。或者xray也可以直接读取这个环境变量?如果有什么别的好方法也 pls let me know!

related #206

@Fangliding
Copy link
Member

挺好看的 就这么用吧()

@Fangliding Fangliding closed this as not planned Won't fix, can't repro, duplicate, stale Apr 14, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants