Add credentials dynamically

[docjojo]

Hello,

is it possible to dynamically add credentials or read credentials from an external file?

I see that credentials are set in eturnal.yml like

credentials:
  alice: l0vesBob
  bob: l0vesAlice
  eve: stalksTh3m

but I would like to dynamically add credentials without touching the eturnal.yml file.

Any idea?

C.

[licaon-kter]

reloading (not restart) the config does not help?

[docjojo]

sure but that would require to edit the file.
i want to register new users and dynamically add user credentials.

[licaon-kter]

So you're editing all sorts of files, running all sorts of commands.... but you don't want to run eturnal reload_config for some reason?

[docjojo]

that's not the point.
i do not want to manually edit the eturnal.yml and add credentials.
i need some automated function.

i could move the credentials to end of eturnal.yml and then append the file with additional credentials. but i was looking for a more convenient solution.

[weiss]

I saw this issue coming when we added support for static credentials, mainly with the intention to allow for quick tests 😃

I wouldn't be keen on adding support for a full-blown DB, but a simple text file sounds okay to me (any suggestion on the exact format?).

[docjojo]

Hello Holger,
could be the same format as eturnal.yml and would just include a credential section.

credentials:
  alice: l0vesBob
  bob: l0vesAlice
  eve: stalksTh3m

I would remove credentials from the eturnal.yml so that the two .yml could be merged.

could be a parameter for reload

eturnalctl reload credentials.yml

but that would not be loaded on start/restart so it should probably just be a file in /etc to be included if it exists, such as eturnal.credentials.yml

[weiss]

Just to give a short feedback, I'd like to either:

1. Add generic support for including YAML config snippets into the main config file (include /etc/eturnal.d/*.yml), not just for credentials specifically. Or
2. Stick to some simple credentials.txt format, just username:password lines or whatever.

I'm still thinking about this.

[docjojo]

1. would require some sort of duplicate check, in case a section already exists in the default config.
2. would probably be easier to implent as it only requires to read the user:pwd like being served in the credentials section.

[docjojo]

I do not want to open a new issues for this question, therefore here:

Is there a way to measure and limit bandwidth for a certain user?