From f154bb8db0db8cd8a0f632c0d06a588152de32c8 Mon Sep 17 00:00:00 2001 From: William Mantly Date: Fri, 17 Jul 2026 23:38:56 -0400 Subject: [PATCH] Bump @simpleworkjs/conf to 1.2.0, jq-repeat to 2.2.0 conf 1.2.0 adds CONF_SECRETS, an env var to point at the secrets file directly -- use it in the Docker entrypoint instead of symlinking the mounted file into /app/conf/secrets.js, so the app no longer needs write access to its own conf/ directory to pick up mounted secrets. jq-repeat 2.2.0 is a compatible feature release (sort(), replace(), faster leading-edge update() timing); no call-site changes needed. Co-Authored-By: Claude Sonnet 5 --- docker-entrypoint.sh | 25 +++++++++++++------------ nodejs/package-lock.json | 12 ++++++------ nodejs/package.json | 4 ++-- 3 files changed, 21 insertions(+), 20 deletions(-) diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh index e51d392..c95d6af 100755 --- a/docker-entrypoint.sh +++ b/docker-entrypoint.sh @@ -6,12 +6,12 @@ # production, run a dedicated LDAP server and point the app at it via app_* # env vars (or a mounted conf/secrets.js) using the app-only image. # -# The app reads its configuration from conf/base.js + conf/secrets.js, deep-merged -# by @simpleworkjs/conf, with `app_*` environment variables as the -# highest-precedence override layer. This entrypoint exports those `app_*` -# vars so the app connects to the bundled slapd without any mounted secrets -# file. Any `app_*` var already set in the environment wins (the values below -# are defaults/fallbacks only). +# The app reads its configuration from conf/base.js + a secrets file, deep-merged +# by @simpleworkjs/conf (requires >= 1.2.0, pinned in nodejs/package-lock.json), +# with `app_*` environment variables as the highest-precedence override layer. +# This entrypoint exports those `app_*` vars so the app connects to the bundled +# slapd without any mounted secrets file. Any `app_*` var already set in the +# environment wins (the values below are defaults/fallbacks only). set -e @@ -33,14 +33,15 @@ error() { echo "[ERROR] $*" >&2; } # ── Optional: load operational config from a mounted secrets.js ────────────── # The unified theta-env stack mounts ./config/sso-secrets.js at /config and # treats it as the authoritative source for the SSO's config (LDAP base, admin -# password, org name, JWT secret, ...). When present, symlink it into -# /app/conf/secrets.js so @simpleworkjs/conf reads it, and override the -# env-derived operational vars below with the file's values. When absent -# (standalone / env-var deployments) the env vars set above stay in effect and -# the app_* exports further down are emitted as before. +# password, org name, JWT secret, ...). When present, point CONF_SECRETS at it +# so @simpleworkjs/conf reads it directly (no write access to /app/conf +# needed), and override the env-derived operational vars below with the +# file's values. When absent (standalone / env-var deployments) the env vars +# set above stay in effect and the app_* exports further down are emitted as +# before. SECRETS_JS_MODE=0 if [[ -f /config/sso-secrets.js ]]; then - ln -sf /config/sso-secrets.js /app/conf/secrets.js + export CONF_SECRETS=/config/sso-secrets.js SECRETS_JS_MODE=1 # Pull the entrypoint's operational vars out of secrets.js in one node call. # Node emits `KEYbase64(value)` lines; we decode each with base64 -d and diff --git a/nodejs/package-lock.json b/nodejs/package-lock.json index bcee38f..1d90703 100644 --- a/nodejs/package-lock.json +++ b/nodejs/package-lock.json @@ -1127,9 +1127,9 @@ } }, "node_modules/@simpleworkjs/conf": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/@simpleworkjs/conf/-/conf-1.1.0.tgz", - "integrity": "sha512-MKRQQ4JAH2tbEm87NdkmfikTT58Tyk/SFbvCC7zKja0bK6j8zYyBXTQUJ0rnvFOVEalDWd/au4AEiptOCEqgvA==", + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/@simpleworkjs/conf/-/conf-1.2.0.tgz", + "integrity": "sha512-X4u1oRb0A0x7wzmyiIH5hPYYIFJYUXhYVe9CPX6G6INouRIeZuHlx0pthHlihiAAIc3+KqZBx18qirFN8RoJwA==", "license": "MIT", "dependencies": { "extend": "^3.0.2" @@ -4357,9 +4357,9 @@ } }, "node_modules/jq-repeat": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/jq-repeat/-/jq-repeat-2.1.0.tgz", - "integrity": "sha512-e1OmSWeBEHEtyOhNVysx0bnT5wd6HlZ37JZgPcGPmACJ0K9bXDPq0xOwrM1slQMSTw7FOSNDX+MD6VwvPeeZyQ==", + "version": "2.2.0", + "resolved": "https://registry.npmjs.org/jq-repeat/-/jq-repeat-2.2.0.tgz", + "integrity": "sha512-OdKAQJ8SOTZzoNL/76o5+WJehXnMCoP8aXbDtZCmDh3vuGGdXfN14FkPTqLpZC5xmlv+QVfTXu/UaIRsDjVuhA==", "license": "MIT", "engines": { "node": ">=14.0.0" diff --git a/nodejs/package.json b/nodejs/package.json index e335b31..6b78c9b 100755 --- a/nodejs/package.json +++ b/nodejs/package.json @@ -23,7 +23,7 @@ "dependencies": { "@fortawesome/fontawesome-free": "^7.3.0", "@popperjs/core": "^2.11.8", - "@simpleworkjs/conf": "^1.1.0", + "@simpleworkjs/conf": "^1.2.0", "bcrypt": "^6.0.0", "bootstrap": "^5.3.8", "compression": "^1.8.1", @@ -31,7 +31,7 @@ "express": "^5.2.1", "express-rate-limit": "^8.5.2", "extend": "^3.0.2", - "jq-repeat": "^2.1.0", + "jq-repeat": "^2.2.0", "jquery": "^3.7.1", "jsonwebtoken": "^9.0.3", "ldapts": "^8.1.2",