Discussion: possibility to "get rid of" `KEYCLOAK_ADMIN` and `KEYCLOAK_ADMIN_PASSWORD` env vars once the stage was bootstrapped about keycloak

[guidograzioli]

oh wow this being 644 is huge issue: https://github.com/ansible-middleware/keycloak/blob/main/roles/keycloak_quarkus/tasks/systemd.yml#L9, definitely needs to be 400
well spotted

As for the envvars I am aware of their single-shot usage; and have been reluctant to do anything without proper thinking, so anybody with idea pls come forward :)

[guidograzioli]

That said, if somebody has enough privileges on the machine to read /etc/sysconfig/ , no envvar protection can really be implemented, because he would be able to read /proc/

[hwo-wd]

Agreed, and https://unix.stackexchange.com/a/433910 also stipulates good argument (about systemd services though); looking at other files in /etc/sysconfig reveal pretty many 0644s though; anyway, thanks for the quick fix.

Thus bringing this issue back to the original question:

how to properly deal with KEYCLOAK_ADMIN[_PASSWORD] env variables

any constructive ideas welcome indeed ;-)