From 8849395fc9c7f98adbf63dcb9ad68a96d225db45 Mon Sep 17 00:00:00 2001 From: jeremy Brown Date: Mon, 31 Aug 2026 11:43:39 +0200 Subject: [PATCH] fix: keep CF_* secrets out of cloudflared's environment cloudflared logs its whole environment at INFO on startup and only redacts variables named TUNNEL_*, so CF_TUNNEL_PASSWORD, CF_API_TOKEN and CF_REMOTE_MANAGE_TOKEN are written verbatim to docker logs. The setup step has already written the tunnel credentials file and referenced it from config.yml, so cloudflared authenticates from that and no longer needs these values in its environment. Strip them at exec. The guards are unaffected as they run before the exec, and --token still receives its value because bash expands it before env removes it. --- .../s6-overlay/s6-rc.d/svc-mod-universal-cloudflared/run | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/root/etc/s6-overlay/s6-rc.d/svc-mod-universal-cloudflared/run b/root/etc/s6-overlay/s6-rc.d/svc-mod-universal-cloudflared/run index ae7d10a53..d14a7c993 100755 --- a/root/etc/s6-overlay/s6-rc.d/svc-mod-universal-cloudflared/run +++ b/root/etc/s6-overlay/s6-rc.d/svc-mod-universal-cloudflared/run @@ -1,9 +1,11 @@ #!/usr/bin/with-contenv bash +strip_secrets=(env -u CF_TUNNEL_PASSWORD -u CF_API_TOKEN -u CF_REMOTE_MANAGE_TOKEN) + if [[ -n "${CF_REMOTE_MANAGE_TOKEN}" ]]; then - exec s6-setuidgid abc cloudflared tunnel --no-autoupdate run --token ${CF_REMOTE_MANAGE_TOKEN} + exec s6-setuidgid abc "${strip_secrets[@]}" cloudflared tunnel --no-autoupdate run --token ${CF_REMOTE_MANAGE_TOKEN} elif [[ ${#CF_ZONE_ID} -gt 0 ]] && [[ ${#CF_ACCOUNT_ID} -gt 0 ]] && [[ ${#CF_API_TOKEN} -gt 0 ]] && [[ ${#CF_TUNNEL_NAME} -gt 0 ]] && [[ ${#CF_TUNNEL_CONFIG} -gt 0 ]] && [[ ${#CF_TUNNEL_PASSWORD} -gt 31 ]]; then - exec s6-setuidgid abc cloudflared tunnel --no-autoupdate --config /etc/cloudflared/config.yml run + exec s6-setuidgid abc "${strip_secrets[@]}" cloudflared tunnel --no-autoupdate --config /etc/cloudflared/config.yml run else echo "**** Issues with cloudflared settings, sleeping ****" sleep infinity