feat!: replace password environment with Docker secret references

validate.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"fmt"
 	"net"
+	"regexp"
 	"strconv"
 	"strings"
 )
@@ -13,6 +14,16 @@ func NormalizeHostname(hostname string) string {
 	return strings.TrimSuffix(strings.ToLower(strings.TrimSpace(hostname)), ".")
 }
 
+const DockerSecretPrefix = "barkstack_"
+
+var secretReferencePattern = regexp.MustCompile(`^[a-z][a-z0-9_]*$`)
+
+// DockerSecretName returns the namespaced Docker object name for a validated
+// short Barkfile secret reference.
+func DockerSecretName(reference string) string {
+	return DockerSecretPrefix + reference
+}
+
 // Validate verifies configuration invariants that do not require opening files.
 func (c Config) Validate() error {
 	var errs []error
@@ -74,8 +85,8 @@ func validatePostgres(postgres PostgresConfig) error {
 	if strings.TrimSpace(postgres.Volume) == "" {
 		return errors.New("volume is required")
 	}
-	if strings.TrimSpace(postgres.PasswordEnv) == "" {
-		return errors.New("password_env is required")
+	if !ValidSecretReference(postgres.PasswordSecret) {
+		return fmt.Errorf("password_secret %q must start with a lowercase letter, contain only lowercase letters, digits, or underscores, and be at most 54 characters", postgres.PasswordSecret)
 	}
 	if postgres.IdleTimeout < 0 {
 		return errors.New("idle_timeout cannot be negative")
@@ -86,6 +97,12 @@ func validatePostgres(postgres PostgresConfig) error {
 	return nil
 }
 
+// ValidSecretReference reports whether reference is safe for use as a short
+// Barkfile secret name and as part of a Docker secret name.
+func ValidSecretReference(reference string) bool {
+	return len(reference) <= 54 && secretReferencePattern.MatchString(reference)
+}
+
 func validateListenAddress(address string) error {
 	_, port, err := net.SplitHostPort(address)
 	if err != nil {