Credentials vs. Core Configuration (sysadmin prog prob #1)

xsawyerx on 2009-07-20T07:05:12

So it's been two weeks since I wrote. I don't find it a big loss, I don't always (correct, "I seldom") write useful or enlightening posts. I usually prefer reading some better material like Ovid, David Golden, Yuval Kogman and other kickass people's journals.

When I write a program with a configuration file, usually the configuration file is composed of two parts:

  • Credentials: the actual user and password (or multiple ones) for databases, web or other interfaces to fetch data from or store in.
  • Core Configuration: configuration for the program. How to act, what to work on, etc.

Many a times I would opt for a database to keep those but usually a YAML configuration file suits me just fine and is easier for others to edit.

However, this configuration file (or database file) will reside in our SCM system (Subversion, Git, whateva') and thus, I cannot store passwords in it. So, I create a copy of the configuration file under "config.yaml.generic", and I shadow the passwords there and put it in subversion.

My problem occurs when I want to make changes. I have to keep config.yaml and config.yaml.generic in sync without keeping the actual passwords in the config.yaml.generic file because it goes in the repository. This is much more annoying when trying to keep more machines in sync with these changes

When writing with Moose, I like to use MooseX::SimpleConfig or MooseX::Getopt to handle my configuration file reading. MX::SimpleConfig is a role by Brandon L. Black that reads files through MooseX::ConfigFromFile which uses Config::Any, which uses whatever it recognizes (through YAML/INI/other modules).

What I wanted to do was separate the entities of the configuration files allowing the credentials to remain unchanged on the server (and not in the repo) and the actual core configuration (that I do want in the repo) to remain in a different file. However, MX::ConfigFromFile and MX::SimpleConfig don't support multiple files, only one.

This is the part in which I praise opensource. I just patched them up to support multiple files (as many as you want), they pass the (actually, very few) tests and I'm gonna also add a test or two to each just to make sure I didn't fsck stuff up, and I'll send patches to Brandon. I hope he's available for this.

Yay opensource communities!