Signing back into the Community for the first time? You'll need to reset your password to access your account. Find out more.
Forum Discussion
How to inject a secret into the environment via a systemd service definition?
I want to inject a secret (password) into the environment for a systemd service, using either Environment= or EnvironmentFile= .
What I tried (and what failed):
1. Environment
Environm...
Hi XIII ! Another option is to write the secret into a private temp file and read it from there into your app. This is secure because systemd creates private temp files in a separate application-specific namespace. In fact by some accounts it's even more secure than environment variables, which can be queried pretty easily from other processes!
My suggestion would look like:
[Service]
ExecStartPre=/path/to/op read op://Vault/Item/password >/tmp/item
ExecStart=/some/app # reads file /tmp/item contents into memory as password
PrivateTmp=yes # Enforces creating /tmp/* in private namespace for the service
