Add ability to read secrets from files

api/adaptors/sql/Cargo.toml

@@ -12,3 +12,4 @@ async-std = { version = "1", features = ["attributes", "tokio1"] }
 sea-orm-migration = "0.11.0"
 serde_json = "1.0.96"
 chrono = "0.4.24"
+url = "2.5.4"

api/adaptors/sql/src/lib.rs

@@ -1,4 +1,4 @@
-use std::{env, error::Error};
+use std::{env, error::Error, fs};
 
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
@@ -13,6 +13,7 @@ use sea_orm::{
     TransactionError, TransactionTrait, TryIntoModel,
 };
 use serde_json::json;
+use url::Url;
 
 mod entity;
 mod migration;
@@ -180,10 +181,28 @@ async fn get_stats_row(db: &DatabaseConnection) -> Result<stats::ActiveModel, Db
     })
 }
 
+fn get_connection_string() -> String {
+    let connection_string =
+        env::var("DATABASE_URL").expect("Expected DATABASE_URL environment variable");
+
+    if let Some(password_file_location) = env::var_os("DATABASE_PASSWORD_FILE") {
+        // The password can be left out of the URL, we add it from the specified
+        // file (presumably under /run/secrets/)
+        let password = fs::read(&password_file_location).unwrap_or_else(|err| {
+            panic!("could not read database password from {password_file_location:?}\n\t{err:?}")
+        });
+        let mut url = Url::parse(&connection_string).expect("invalid connection string");
+        url.set_password(Some(String::from_utf8_lossy(password.as_slice()).as_ref()))
+            .unwrap_or_else(|_| panic!("invalid database URL: {connection_string:?}"));
+        url.to_string()
+    } else {
+        connection_string
+    }
+}
+
 impl SqlAdaptor {
     pub async fn new() -> Self {
-        let connection_string =
-            env::var("DATABASE_URL").expect("Expected DATABASE_URL environment variable");
+        let connection_string = get_connection_string();
 
         // Connect to the database
         let db = Database::connect(&connection_string)