feat(config): read secrets from NAME_FILE variables (#1421)

Co-authored-by: Hampus <[email protected]>

packages/config/src/__tests__/ConfigLoader.test.ts

@@ -1,6 +1,9 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
 import {generateKeyPairSync} from 'node:crypto';
+import {mkdtempSync, rmSync, writeFileSync} from 'node:fs';
+import {tmpdir} from 'node:os';
+import {join} from 'node:path';
 import {getConfig, loadConfig, resetConfig} from '@fluxer/config/src/ConfigLoader';
 import {afterEach, beforeEach, describe, expect, test, vi} from 'vitest';
 
@@ -80,6 +83,24 @@ describe('ConfigLoader', () => {
 		expect((await loadConfig()).domain.base_domain).toBe('localhost');
 	});
 
+	test('loadConfig reads secrets from NAME_FILE', async () => {
+		const dir = mkdtempSync(join(tmpdir(), 'fluxer-config-file-'));
+		try {
+			const path = join(dir, 'postgres_password');
+			writeFileSync(path, 'from-secret-file\n');
+			stubMinimalEnv({FLUXER_POSTGRES_PASSWORD: '', FLUXER_POSTGRES_PASSWORD_FILE: path});
+			const config = await loadConfig();
+			expect(config.database.postgres.password).toBe('from-secret-file');
+		} finally {
+			rmSync(dir, {recursive: true, force: true});
+		}
+	});
+
+	test('loadConfig rejects NAME and NAME_FILE together', async () => {
+		stubMinimalEnv({FLUXER_SUDO_MODE_SECRET_FILE: '/run/secrets/sudo'});
+		await expect(loadConfig()).rejects.toThrow('FLUXER_SUDO_MODE_SECRET and FLUXER_SUDO_MODE_SECRET_FILE are both set');
+	});
+
 	test('getConfig throws when config is not loaded', () => {
 		expect(() => getConfig()).toThrow('Config not loaded');
 	});