hanna/fabrica

fix(config): tolerate a not-yet-generated auth.secret_file

dad15c0 · hanna committed on 2026-07-26

The example config sets `auth.secret_file` and documents it as "generated on
first run", but config load hard-read the file and errored when it was missing —
so a fresh container (empty volume) crash-looped with "failed to read secret
file" before `ensure_secret` could create it. Treat a NotFound secret_file as
absent (the server generates and persists one); a present-but-unreadable file
stays a hard error, and a missing mail password_file still errors.

Also create /var/lib/fabrica owned by the fabrica user in the image so first-run
generation (signing secret, SQLite database, repos) can actually write to it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

Dockerfile +5 −1

crates/config/src/lib.rs +25 −6

     && rm -rf /var/lib/apt/lists/* \
     && git --version
-RUN useradd --uid 10001 --system --home-dir /var/lib/fabrica --shell /usr/sbin/nologin fabrica
+RUN useradd --uid 10001 --system --home-dir /var/lib/fabrica --shell /usr/sbin/nologin fabrica \
+    && install -d -o fabrica -g fabrica -m 0750 /var/lib/fabrica
 COPY --from=builder /build/target/release/fabrica /usr/local/bin/fabrica
 RUN fabrica --version && git --version
 USER fabrica
+# The data directory is created and owned by the fabrica user above so first-run
+# generation (signing secret, SQLite database, repos) can write to it. A bind
+# mount overrides this ownership — chown it to uid 10001 on the host.
 VOLUME /var/lib/fabrica
 EXPOSE 8080 2222

 /// Read any `*_file` secrets and fold them onto their inline siblings.
 fn resolve_secret_files(config: &mut Config) -> Result<(), ConfigError> {
     if let Some(path) = &config.auth.secret_file {
-        config.auth.secret = Some(read_secret(path)?);
+        // The HS256 signing key is generated on first run (see the CLI's
+        // `ensure_secret`), so a not-yet-created file is expected and fine — the
+        // inline secret stays `None` and the server writes one. Only a file that
+        // exists but cannot be read (e.g. permissions) is a hard error.
+        match read_secret(path) {
+            Ok(secret) => config.auth.secret = Some(secret),
+            Err(ConfigError::SecretFile { source, .. })
+                if source.kind() == std::io::ErrorKind::NotFound => {}
+            Err(e) => return Err(e),
+        }
+    }
     if let Some(path) = &config.mail.password_file {
         config.mail.password = Some(read_secret(path)?);
+    }
     #[test]
-    fn missing_secret_file_errors() {
+    fn missing_auth_secret_file_is_tolerated() {
-        let err = from_toml("[auth]\nsecret_file = \"/no/such/fabrica/secret\"\n").unwrap_err();
+        // The signing key is generated on first run, so a not-yet-created
+        // secret_file must not fail config load — the inline secret stays unset
+        // and the server writes one.
+        let loaded = from_toml("[auth]\nsecret_file = \"/no/such/fabrica/secret\"\n").unwrap();
+        assert!(loaded.config.auth.secret.is_none());
+    }
+    #[test]
+    fn missing_mail_password_file_errors() {
+        // A mail password file is operator-provided, not generated, so a missing
+        // one is a real misconfiguration.
+        let err =
+            from_toml("[mail]\npassword_file = \"/no/such/fabrica/mail-pass\"\n").unwrap_err();
         match err {
-            ConfigError::SecretFile { path, .. } => {
+            ConfigError::SecretFile { path, .. } => assert!(path.ends_with("mail-pass")),
-                assert!(path.ends_with("secret"));
-            }
             other => panic!("expected SecretFile, got {other:?}"),
+        }
+    }