hanna/fabrica

fix(config): tolerate a not-yet-generated auth.secret_file

dad15c0 · hanna committed on 2026-07-26

The example config sets `auth.secret_file` and documents it as "generated on
first run", but config load hard-read the file and errored when it was missing —
so a fresh container (empty volume) crash-looped with "failed to read secret
file" before `ensure_secret` could create it. Treat a NotFound secret_file as
absent (the server generates and persists one); a present-but-unreadable file
stays a hard error, and a missing mail password_file still errors.

Also create /var/lib/fabrica owned by the fabrica user in the image so first-run
generation (signing secret, SQLite database, repos) can actually write to it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

Dockerfile +5 −1

crates/config/src/lib.rs +25 −6

     && rm -rf /var/lib/apt/lists/* \
     && git --version
 RUN useradd --uid 10001 --system --home-dir /var/lib/fabrica --shell /usr/sbin/nologin fabrica
 RUN useradd --uid 10001 --system --home-dir /var/lib/fabrica --shell /usr/sbin/nologin fabrica \
     && install -d -o fabrica -g fabrica -m 0750 /var/lib/fabrica
 COPY --from=builder /build/target/release/fabrica /usr/local/bin/fabrica
 RUN fabrica --version && git --version
 USER fabrica
 # The data directory is created and owned by the fabrica user above so first-run
 # generation (signing secret, SQLite database, repos) can write to it. A bind
 # mount overrides this ownership — chown it to uid 10001 on the host.
 VOLUME /var/lib/fabrica
 EXPOSE 8080 2222

@@ @@ -139,7 +139,16 @@ fn xdg_config_path() -> Option<PathBuf> { @@
 /// Read any `*_file` secrets and fold them onto their inline siblings.
 fn resolve_secret_files(config: &mut Config) -> Result<(), ConfigError> {
     if let Some(path) = &config.auth.secret_file {
         config.auth.secret = Some(read_secret(path)?);
         // The HS256 signing key is generated on first run (see the CLI's
         // `ensure_secret`), so a not-yet-created file is expected and fine — the
         // inline secret stays `None` and the server writes one. Only a file that
         // exists but cannot be read (e.g. permissions) is a hard error.
         match read_secret(path) {
             Ok(secret) => config.auth.secret = Some(secret),
             Err(ConfigError::SecretFile { source, .. })
                 if source.kind() == std::io::ErrorKind::NotFound => {}
             Err(e) => return Err(e),
+        }
+    }
     if let Some(path) = &config.mail.password_file {
         config.mail.password = Some(read_secret(path)?);
@@ @@ -453,12 +462,22 @@ mod tests { @@
+    }
     #[test]
     fn missing_secret_file_errors() {
         let err = from_toml("[auth]\nsecret_file = \"/no/such/fabrica/secret\"\n").unwrap_err();
     fn missing_auth_secret_file_is_tolerated() {
         // The signing key is generated on first run, so a not-yet-created
         // secret_file must not fail config load — the inline secret stays unset
         // and the server writes one.
         let loaded = from_toml("[auth]\nsecret_file = \"/no/such/fabrica/secret\"\n").unwrap();
         assert!(loaded.config.auth.secret.is_none());
+    }
     #[test]
     fn missing_mail_password_file_errors() {
         // A mail password file is operator-provided, not generated, so a missing
         // one is a real misconfiguration.
         let err =
             from_toml("[mail]\npassword_file = \"/no/such/fabrica/mail-pass\"\n").unwrap_err();
         match err {
             ConfigError::SecretFile { path, .. } => {
                 assert!(path.ends_with("secret"));
+            }
             ConfigError::SecretFile { path, .. } => assert!(path.ends_with("mail-pass")),
             other => panic!("expected SecretFile, got {other:?}"),
+        }
+    }