From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: mail.toke.dk; dkim=fail reason="signature verification failed" header.d=webweaving.org header.i=@webweaving.org header.a=rsa-sha256 header.s=shared header.b="AIbmWJ/Y"; arc=none (Message is not ARC signed); dmarc=fail (Used From Domain Record) header.from=webweaving.org policy.dmarc=none Received: from weser.webweaving.org (weser.webweaving.org [148.251.234.232]) by mail.toke.dk (Postfix) with ESMTPS id 2D3A11323280 for ; Sat, 11 Jul 2026 15:08:33 +0200 (CEST) Received: from smtpclient.apple (delta.ree.webweaving.org [62.45.240.219]) (authenticated bits=0) by weser.webweaving.org (8.18.2/8.18.1) with ESMTPSA id 66BD8VBv004960 (version=TLSv1.2 cipher=ECDHE-ECDSA-AES256-GCM-SHA384 bits=256 verify=NO); Sat, 11 Jul 2026 15:08:32 +0200 (CEST) (envelope-from dirkx@webweaving.org) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=webweaving.org; s=shared; t=1783775312; bh=ZPSEnrcen5tccTHLb1KeJV3uJzM9pkAQD6nm7nsaCpg=; h=From:Subject:Date:In-Reply-To:Cc:To:References; b=AIbmWJ/YjTSCW9uSU0MEBcUZ2k5XxZWPHw/Ti0/l7QL6LqCeWZG9/X5QOlqCTKX5I vbrKgkb6IniZt7EWxvkNWP5hcB0ebYEL+IDOKlPMiB6JH7RKnBZn+QLvVblmbPMBQZ wl+oeDB7C2ClHTCrJ+w0zWz32MF17C6t2iGNDf20= X-Authentication-Warning: weser.webweaving.org: Host delta.ree.webweaving.org [62.45.240.219] claimed to be smtpclient.apple From: Dirk-Willem van Gulik Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_4DD85528-231E-4545-8775-37E8F1D523C1" Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.600.51.1.1\)) Date: Sat, 11 Jul 2026 15:07:30 +0200 In-Reply-To: <9342d9f8-42e6-4a9b-88d0-dc05ac7bd561@movim.eu> Cc: Juliusz Chroboczek , galene@lists.galene.org To: =?utf-8?Q?Timoth=C3=A9e_Jaussoin?= References: <87se5ppzq0.wl-jch@irif.fr> <9342d9f8-42e6-4a9b-88d0-dc05ac7bd561@movim.eu> X-Mailer: Apple Mail (2.3864.600.51.1.1) X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.6.4 (weser.webweaving.org [148.251.234.232]); Sat, 11 Jul 2026 15:08:32 +0200 (CEST) Message-ID-Hash: X2PPQFZNABAU7ZG7J3G5KJ47D2UGEKOO X-Message-ID-Hash: X2PPQFZNABAU7ZG7J3G5KJ47D2UGEKOO X-MailFrom: dirkx@webweaving.org X-Mailman-Rule-Hits: member-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency X-Mailman-Version: 3.3.10 Precedence: list Subject: [Galene] Re: Galene HTTP API error and various feedback List-Id: =?utf-8?q?Gal=C3=A8ne_videoconferencing_server_discussion_list?= Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --Apple-Mail=_4DD85528-231E-4545-8775-37E8F1D523C1 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On 11 Jul 2026, at 15:04, Timoth=C3=A9e Jaussoin = wrote: > Le 11/07/2026 =C3=A0 12:50, Juliusz Chroboczek a =C3=A9crit : ... >> sed "s/@PASSWORD@/$pw/" < /etc/galene.conf.template > = /tmp/galene.conf >> galene -c /tmp/galene.conf >>=20 >> So I'm not too keen to add code that I'm going to have to maintain = forever >> just to avoid a few lines of shell. Is there any reason why you need = this >> to be done within the server itsef? > Having something like DotEnv (https://www.dotenv.org/docs/) to = configure Galene would even be better. Then you can launch it using a = standard file and environnement variable (which is really useful when = you wrap it in containers :)). I'd be a bit cautious when it comes to putting secrets in ENV variables = (or passing them on the command line) -- as they can leak via an = strategic `ps -aux, -elwf, etc) or via a well meaning Nagions, SNMP or = other monitoring system. Best to pass these by root-protected files, via socket/device or on a = file descriptor -- e.g. see openssl or pgp/gpg for examples. With kind regards, Dw=20 --Apple-Mail=_4DD85528-231E-4545-8775-37E8F1D523C1 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On 11 Jul 2026, at 15:04, Timoth=C3=A9e = Jaussoin <edhelas@movim.eu> wrote:
Le 11/07/2026 =C3=A0 12:50, Juliusz Chroboczek a =C3=A9crit :
...
    sed "s/@PASSWORD@/$pw/" =
< /etc/galene.conf.template > /tmp/galene.conf
    galene -c /tmp/galene.conf

So I'm not too keen to add code that I'm going to have to maintain =
forever
just to avoid a few lines of shell.  Is there any reason why you need =
this
to be done within the server itsef?
Having something like DotEnv (https://www.dotenv.org/docs/) = to configure Galene would even be better. Then you can launch it using a standard file and environnement variable (which is really useful when you wrap it in containers :)).

I'd be a bit cautious when = it comes to putting secrets in ENV variables (or passing them on the = command line) -- as they can leak via an strategic `ps -aux, -elwf, etc) = or via a well meaning Nagions, SNMP or other monitoring = system.

Best to pass these by root-protected = files, via socket/device or on a file descriptor -- e.g. see openssl or = pgp/gpg for examples.

With kind = regards,

Dw 

= --Apple-Mail=_4DD85528-231E-4545-8775-37E8F1D523C1--