github/dokku
0
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix: report traefik dns-provider env vars as global keys

Browse Source 
The dynamic `dns-provider-*` properties were reported as `--traefik-dns-provider-<env_var>`, outside the `global`/`computed` namespace every other traefik property uses, so a consumer reading the json report could not tell which of the two a key represented. They are now reported as `--traefik-global-dns-provider-<env_var>`. The `basic-auth-password` property is a credential as well and is now masked in the default report output on the same terms as the dns provider values, meaning the raw value is returned only for `--format json` or when the flag is queried by name.
This commit is contained in:
Jose Diaz-Gonzalez
2026-08-12 03:22:04 -04:00
parent adf2bd14fb
commit 81a929d768
7 changed files with 275 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

66
tests/unit/traefik-vhosts.bats
View File

@@ -3,11 +3,14 @@
load test_helper
setup() {
dokku traefik:set --global basic-auth-password
dokku traefik:set --global dns-provider-test_key
create_app
}
teardown() {
destroy_app
dokku traefik:set --global basic-auth-password >/dev/null 2>&1 || true
dokku traefik:set --global challenge-mode >/dev/null 2>&1 || true
dokku traefik:set --global dns-provider-test_key >/dev/null 2>&1 || true
}
@@ -58,15 +61,74 @@ teardown() {
assert_success
assert_output_contains "*******"
run /bin/bash -c "dokku traefik:report --global --traefik-dns-provider-test_key"
run /bin/bash -c "dokku traefik:report --global --traefik-global-dns-provider-test_key"
echo "output: $output"
echo "status: $status"
assert_success
assert_output "secretvalue"
run /bin/bash -c "dokku traefik:report --global --format json | jq -r '.\"dns-provider-test_key\"'"
run /bin/bash -c "dokku traefik:report --global --format json | jq -r '.\"global-dns-provider-test_key\"'"
echo "output: $output"
echo "status: $status"
assert_success
assert_output "secretvalue"
}
@test "(traefik:report) basic-auth-password is masked unless queried" {
run /bin/bash -c "dokku traefik:report --global --format json | jq -r '.\"global-basic-auth-password\"'"
echo "output: $output"
echo "status: $status"
assert_success
assert_output ""
run /bin/bash -c "dokku traefik:report --global | grep 'basic auth password'"
echo "output: $output"
echo "status: $status"
assert_success
assert_output_not_contains "*******"
run /bin/bash -c "dokku traefik:set --global basic-auth-password secretpassword"
assert_success
run /bin/bash -c "dokku traefik:report --global | grep 'basic auth password'"
echo "output: $output"
echo "status: $status"
assert_success
assert_output_contains "*******" 2
assert_output_not_contains "secretpassword"
run /bin/bash -c "dokku traefik:report --global --traefik-global-basic-auth-password"
echo "output: $output"
echo "status: $status"
assert_success
assert_output "secretpassword"
run /bin/bash -c "dokku traefik:report --global --traefik-computed-basic-auth-password"
echo "output: $output"
echo "status: $status"
assert_success
assert_output "secretpassword"
run /bin/bash -c "dokku traefik:report --global --format json | jq -r '.\"global-basic-auth-password\"'"
echo "output: $output"
echo "status: $status"
assert_success
assert_output "secretpassword"
}
@test "(traefik:report) credentials are masked in the aggregate report" {
run /bin/bash -c "dokku traefik:set --global dns-provider-test_key secretvalue"
assert_success
run /bin/bash -c "dokku traefik:set --global basic-auth-password secretpassword"
assert_success
run /bin/bash -c "dokku report $TEST_APP"
echo "output: $output"
echo "status: $status"
assert_success
assert_output_contains "global dns provider test_key"
assert_output_contains "*******" -1
assert_output_not_contains "secretvalue"
assert_output_not_contains "secretpassword"
}

18
tests/unit/traefik.bats
View File

@@ -10,6 +10,8 @@ setup() {
dokku traefik:set --global api-enabled
dokku traefik:set --global api-entry-point
dokku traefik:set --global api-entry-point-address
dokku traefik:set --global basic-auth-username
dokku traefik:set --global basic-auth-password
dokku traefik:set --global challenge-mode
dokku traefik:set --global dns-provider
dokku traefik:start
@@ -539,19 +541,19 @@ teardown() {
echo "output: $output"
echo "status: $status"
assert_success
assert_output_contains "dns provider cf_api_email"
assert_output_contains "dns provider cf_api_key"
assert_output_contains "global dns provider cf_api_email"
assert_output_contains "global dns provider cf_api_key"
assert_output_contains "*******" 2
assert_output_not_contains "test@example.com"
assert_output_not_contains "secret-key"
run /bin/bash -c "dokku traefik:report $TEST_APP --traefik-dns-provider-cf_api_email"
run /bin/bash -c "dokku traefik:report $TEST_APP --traefik-global-dns-provider-cf_api_email"
echo "output: $output"
echo "status: $status"
assert_success
assert_output "test@example.com"
run /bin/bash -c "dokku traefik:report $TEST_APP --traefik-dns-provider-cf_api_key"
run /bin/bash -c "dokku traefik:report $TEST_APP --traefik-global-dns-provider-cf_api_key"
echo "output: $output"
echo "status: $status"
assert_success
@@ -571,8 +573,8 @@ teardown() {
echo "output: $output"
echo "status: $status"
assert_success
assert_output_not_contains "dns provider cf_api_email"
assert_output_not_contains "dns provider cf_api_key"
assert_output_not_contains "global dns provider cf_api_email"
assert_output_not_contains "global dns provider cf_api_key"
}
@test "(traefik) [dns-01] dns-provider-* can only be set globally" {
@@ -610,13 +612,13 @@ teardown() {
echo "status: $status"
assert_success
run /bin/bash -c "dokku traefik:report $TEST_APP --format json | jq -r '.\"dns-provider-cf_api_email\"'"
run /bin/bash -c "dokku traefik:report $TEST_APP --format json | jq -r '.\"global-dns-provider-cf_api_email\"'"
echo "output: $output"
echo "status: $status"
assert_success
assert_output "test@example.com"
run /bin/bash -c "dokku traefik:report $TEST_APP --format json | jq -r '.\"dns-provider-cf_api_key\"'"
run /bin/bash -c "dokku traefik:report $TEST_APP --format json | jq -r '.\"global-dns-provider-cf_api_key\"'"
echo "output: $output"
echo "status: $status"
assert_success