Add LIVEKIT_KEY_FILE, rename env vars to _FROM_FILE and trim keys&secrets (#93)

* Add LIVEKIT_KEY_SECRET_FILE and trim keys&secrets * Rename env vars for consistency with livekit * Add LIVEKIT_KEY_FILE variable in README * comment readKeySecret logic * reformat var names

Author: gaelgatelement

README.md

@@ -52,8 +52,9 @@ The service is configured via environment variables:
 Variable | Description | Required
 --- | --- | ---
 `LIVEKIT_URL` | The websocket URL of the LiveKit SFU | Yes
-`LIVEKIT_KEY` or `LIVEKIT_KEY_FILE` | The API key or key file path for the LiveKit SFU | Yes
-`LIVEKIT_SECRET` or `LIVEKIT_SECRET_FILE` | The secret or secret file path for the LiveKit SFU | Yes
+`LIVEKIT_KEY` or `LIVEKIT_KEY_FROM_FILE` | The API key or key file path for the LiveKit SFU | Yes
+`LIVEKIT_SECRET` or `LIVEKIT_SECRET_FROM_FILE` | The secret or secret file path for the LiveKit SFU | Yes
+`LIVEKIT_KEY_FILE` | file path to LiveKit SFU key-file format (`APIkey: secret`) | mutually exclusive with `LIVEKIT_KEY` and `LIVEKIT_SECRET`
 `LIVEKIT_JWT_PORT` | The port the service listens on | No - defaults to 8080
 
 ## Disable TLS verification

main.go

@@ -24,6 +24,7 @@ import (
 "net/http"
 "os"
 "crypto/tls"
+"strings"
 
 "time"
 
@@ -186,27 +187,49 @@ func (h *Handler) prepareMux() *http.ServeMux {
 }
 
 func readKeySecret() (string, string) {
+// We initialize keys & secrets from environment variables
 key := os.Getenv("LIVEKIT_KEY")
 secret := os.Getenv("LIVEKIT_SECRET")
-key_path := os.Getenv("LIVEKIT_KEY_FILE")
-secret_path := os.Getenv("LIVEKIT_SECRET_FILE")
-if key_path != "" {
-if keyBytes, err := os.ReadFile(key_path); err != nil {
+// We initialize potential key & secret path from environment variables
+keyPath := os.Getenv("LIVEKIT_KEY_FROM_FILE")
+secretPath := os.Getenv("LIVEKIT_SECRET_FROM_FILE")
+keySecretPath := os.Getenv("LIVEKIT_KEY_FILE")
+
+// If keySecretPath is set we read the file and split it into two parts
+// It takes over any other initialization
+if keySecretPath != "" {
+if keySecretBytes, err := os.ReadFile(keySecretPath); err != nil {
 log.Fatal(err)
 } else {
-key = string(keyBytes)
+key_secrets := strings.Split(string(keySecretBytes), ":")
+if len(key_secrets) != 2 {
+log.Fatalf("invalid key secret file format!")
+}
+key = key_secrets[0]
+secret = key_secrets[1]
+}
+} else {
+// If keySecretPath is not set, we try to read the key and secret from files
+// If those files are not set, we return the key & secret from the environment variables
+if keyPath != "" {
+if keyBytes, err := os.ReadFile(keyPath); err != nil {
+log.Fatal(err)
+} else {
+key = string(keyBytes)
+}
 }
-}
 
-if secret_path != "" {
-if secretBytes, err := os.ReadFile(secret_path); err != nil {
-log.Fatal(err)
-} else {
-secret = string(secretBytes)
+if secretPath != "" {
+if secretBytes, err := os.ReadFile(secretPath); err != nil {
+log.Fatal(err)
+} else {
+secret = string(secretBytes)
+}
 }
+
 }
 
-return key, secret
+return strings.Trim(key, " \r\n"), strings.Trim(secret, " \r\n")
 }
 
 func main() {

main_test.go

@@ -240,29 +240,37 @@ func TestReadKeySecret(t *testing.T) {
 expectedSecret: "from_env_ahb8eiwae0viey7gee4ieNgahgeeQuie",
 err: false,
 },
+{
+name: "Read from livekit keysecret",
+env: map[string]string{
+"LIVEKIT_KEY_FILE": "./tests/keysecret.yaml",
+},
+expectedKey: "keysecret_iethuB2LeLiNuishiaKeephei9jaatio",
+expectedSecret: "keysecret_xefaingo4oos6ohla9phiMieBu3ohJi2",
+},
 {
 name: "Read from file",
 env: map[string]string{
-"LIVEKIT_KEY_FILE": "./tests/key",
-"LIVEKIT_SECRET_FILE": "./tests/secret",
+"LIVEKIT_KEY_FROM_FILE": "./tests/key",
+"LIVEKIT_SECRET_FROM_FILE": "./tests/secret",
 },
 expectedKey: "from_file_oquusheiheiw4Iegah8te3Vienguus5a",
 expectedSecret: "from_file_vohmahH3eeyieghohSh3kee8feuPhaim",
 },
 {
 name: "Read from file key only",
 env: map[string]string{
-"LIVEKIT_KEY_FILE": "./tests/key",
-"LIVEKIT_SECRET": "from_env_ahb8eiwae0viey7gee4ieNgahgeeQuie",
+"LIVEKIT_KEY_FROM_FILE": "./tests/key",
+"LIVEKIT_SECRET":  "from_env_ahb8eiwae0viey7gee4ieNgahgeeQuie",
 },
 expectedKey: "from_file_oquusheiheiw4Iegah8te3Vienguus5a",
 expectedSecret: "from_env_ahb8eiwae0viey7gee4ieNgahgeeQuie",
 },
 {
 name: "Read from file secret only",
 env: map[string]string{
-"LIVEKIT_SECRET_FILE": "./tests/secret",
-"LIVEKIT_KEY": "from_env_qui8aiTopiekiechah9oocbeimeew2O",
+"LIVEKIT_SECRET_FROM_FILE": "./tests/secret",
+"LIVEKIT_KEY":  "from_env_qui8aiTopiekiechah9oocbeimeew2O",
 },
 expectedKey: "from_env_qui8aiTopiekiechah9oocbeimeew2O",
 expectedSecret: "from_file_vohmahH3eeyieghohSh3kee8feuPhaim",

tests/key

@@ -1 +1 @@
-from_file_oquusheiheiw4Iegah8te3Vienguus5a
+from_file_oquusheiheiw4Iegah8te3Vienguus5a

tests/keysecret.yaml

@@ -0,0 +1 @@
+keysecret_iethuB2LeLiNuishiaKeephei9jaatio: keysecret_xefaingo4oos6ohla9phiMieBu3ohJi2

tests/secret

@@ -1 +1 @@
-from_file_vohmahH3eeyieghohSh3kee8feuPhaim
+from_file_vohmahH3eeyieghohSh3kee8feuPhaim