Providing MS_ENCRYPTION_KEY as an enviornment variable instead of a file in a mapserver mapfile

Question

In order to use a secured WMS service in a mapfile, one can directly provide credentials as follow:

LAYER
    NAME "topic-infra-service"
    TYPE RASTER
    STATUS ON
    CONNECTION "https://server.com/path/to/topic/wms?"
    CONNECTIONTYPE WMS
    MINSCALEDENOM  1
    MAXSCALEDENOM  2000
    METADATA
        "wms_srs"               "EPSG:2056"
        "wms_name"              "infrastructure-layer"
        "wms_server_version"    "1.3.0"
        "wms_format"            "image/png"
        "wms_auth_type"         "basic"
        "wms_auth_username"     "<username>" # <----- service clear user name
        "wms_auth_password"     "<password>" # <----- service clear user password
        "wms_exceptions_format" "application/vnd.ogc.se_xml"
    END
END

The idea here is naturally not to have these values clearly exposed in the mapfile.

Hence, I'm studying a way to pass those parameters directly from environment variables (e.g from a .env file).

There seems to be a way to feed the LAYER an encrypted password using an encryption key as described here: https://mapserver.org/utilities/msencrypt.html

But this seems to exclusively rely on a file which contains the encryption key, unless I missed something:

To encrypt a string:

msencrypt -key [key_filename] [string_to_encrypt]

Therefore, in order to decode the string_to_encrypt, e.g. a password or a database connection string, one has to specify the path of the key file as the MS_ENCRYPTION_KEY variable in the mapfile.

And as I'm working in a dockerized environment, I need to directly make use an environment variable containing the encryption key instead of a file when defining this MS_ENCRYPTION_KEY var in the mapfile. Is this possible? If yes, how?

The Docker image running mapserver already starts the web server. I cannot modify the Dockerfile, but I can modify the compose file which spins the mapserver service based on this image. After some attempts, it seems that any custom commands or entrypoint (such as one building the key.file from an environment variable passed to the compose service) overrides the mapserver server process itself, crashing it. That's why I want to directly use the environment variable.

Answer 1

MS_ENCRYPTION_KEY can only refer to a file - as the code tries to read the path from this setting: https://github.com/MapServer/MapServer/blob/f478a37305cc3646aea7fd618e27ded429367183/mapcrypto.c#L276

You can set MS_ENCRYPTION_KEY using an environment variable rather than in the Mapfile, or set it in the new CONFIG file available in MapServer 8.0

You can share a volume with Docker in order to copy the encryption file (and/or CONFIG file) to the running Docker machine without making any modifications to the Dockerfile itself - see https://stackoverflow.com/a/39415099/179520