Require JWT secret, remove default, optionally read from file

Fixes #474, fixes #495 when file is used

main/Main.hs

@@ -12,6 +12,7 @@ import           PostgREST.OpenAPI                    (isMalformedProxyUri)
 import           PostgREST.DbStructure
 
 import           Data.String                          (IsString (..))
+import           Data.Text                            (stripPrefix)
 import           Data.Function                        (id)
 import qualified Hasql.Query                          as H
 import qualified Hasql.Session                        as H
@@ -21,7 +22,6 @@ import qualified Hasql.Pool                           as P
 import           Network.Wai.Handler.Warp
 import           System.IO                            (BufferMode (..),
                                                        hSetBuffering)
-import           Web.JWT                              (secret)
 import           Data.IORef
 #ifndef mingw32_HOST_OS
 import           System.Posix.Signals
@@ -42,7 +42,7 @@ main = do
   hSetBuffering stdin  LineBuffering
   hSetBuffering stderr NoBuffering
 
-  conf <- readOptions
+  conf <- loadSecretFile =<< readOptions
   let host = configHost conf
       port = configPort conf
       proxy = configProxyUri conf
@@ -55,8 +55,6 @@ main = do
   when (isMalformedProxyUri $ toS <$> proxy) $ panic
     "Malformed proxy uri, a correct example: https://example.com:8443/basePath"
 
-  unless (secret "secret" /= configJwtSecret conf) $
-    putStrLn ("WARNING, running in insecure mode, JWT secret is the default value" :: Text)
   putStrLn $ ("Listening on port " :: Text) <> show (configPort conf)
 
   pool <- P.acquire (configPool conf, 10, pgSettings)
@@ -86,3 +84,11 @@ main = do
 #endif
 
   runSettings appSettings $ postgrest conf refDbStructure pool
+
+loadSecretFile :: AppConfig -> IO AppConfig
+loadSecretFile conf = do
+  let s = configJwtSecret conf
+  real <- case stripPrefix "@" s of
+            Nothing -> return s -- the string is the secret, not a filename
+            Just filename -> readFile (toS filename)
+  return conf { configJwtSecret = real }