node-deepstackai-trigger: triggerUri exposes plain text Blue Iris Username and Password
Is your feature request related to a problem? Please describe.
When adding a triggerUri
for a Blue Iris system that requires authentication, my user
and pw
are in a file in plain text.
Describe the solution you’d like Preferably this would be a secret, environment variable, or in a file of key/value pairs that get’s ignored when a user backs up their configuration (similar to home assistant: https://www.home-assistant.io/docs/configuration/secrets/).
The best solution in my mind would be to take mustache templating further. For example in the docs there is:
"http://192.168.1.100:81/admin?trigger&camera=FrontDoorHD&user=username&pw=password"
This could become:
"http://192.168.1.100:81/admin?trigger&camera=FrontDoorHD&user={blueIris.username}&pw={blueIris.password}"
This could look inside settings.json
. Then alternatively settings.json
could use mustache templating to look to an environment variable or secret or key/value pair file; which would be a benefit to all the other settings that have a username/password. Then the mustache templating in triggerUri
could consistently look to settings.json
. Something like:
{
"blueIris": {
"username": "{ENV.BLUE_IRIS_USERNAME}",
"password": "{ENV.BLUE_IRIS_PASSWORD}"
}
}
…or possibly SECRET.BLUE_IRIS_PASSWORD
or something along those lines.
Describe alternatives you’ve considered I described a couple alternatives above.
Additional context
I think the main problem here is the need to separate configuration from secrets. If my server dies, how do I get my configuration back to get up and running again; ideally it’s backed up, but it shouldn’t be backed up with plain text secrets. With my other docker containers I have written a shell script that grabs usernames/passwords from LastPass using their cli and then uses sed
to drop them in .env
files and then I reference those .env
files in my docker-compose
(https://docs.docker.com/compose/environment-variables/#the-env_file-configuration-option).
ALSO, I love node/typescript and can probably provide some assistance in this implementation.
ALSO ALSO, thanks to everyone that has contributed to this project. I absolutely love it!
About this issue
- Original URL
- State: closed
- Created 4 years ago
- Comments: 20 (19 by maintainers)
@schford This isn’t specific to BlueIris username/password. The API keys and whatnot for the other notification methods are required and considered secrets as well.
When you do your next PR make sure you pull in my change for #380 from main.