Class EnvironmentSecret

java.lang.Object
com.mcpdbwizard.pub.EnvironmentSecret
public final class EnvironmentSecret extends Object
Reads a secret from the environment, either directly or from a file the environment points at.

Setting DB_PASS works. So does setting DB_PASS_FILE to a path whose contents are the secret — the convention the official postgres and mysql images use, and what Docker Swarm secrets and Kubernetes secret volumes are shaped for.

The file form is the better one, and not by much effort:

  • it does not appear in docker inspect;
  • it is not inherited by every child process, which matters here because the web application forks the generator and the generated MCP server;
  • secret mounts are tmpfs-backed rather than written to the image or a disk layer;
  • it can be rotated by replacing the file.

Both set at once is an error rather than a precedence rule. Two sources for one secret is a misconfiguration, and quietly preferring one hides which credential is actually in use — the sort of thing found only when the wrong one expires. Copyright 2003-2026 ATB Consultancy Services Ltd (formerly Orinda Software Ltd, Dublin, Ireland)

  • Field Details

    • FILE_SUFFIX

      public static final String FILE_SUFFIX
      Appended to a variable name to get the one naming a file instead.
      See Also:

  • Method Details

    • read

      public static String read(String theVariableName)
      The secret, or null when neither variable is set.
      Parameters:
      theVariableName - e.g. DB_PASS; DB_PASS_FILE is consulted too
      Throws:
      IllegalStateException - if both are set, or the file cannot be read, or it is empty