feat: add ldap bind password file (#929)

.github/workflows/ci.yml

@@ -23,7 +23,7 @@ jobs:
       - name: Setup go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
-          go-version: "^1.26.0"
+          go-version: "^1.26.4"
 
       - name: Go dependencies
         run: go mod download

.github/workflows/nightly.yml

@@ -67,7 +67,7 @@ jobs:
       - name: Install go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
-          go-version: "^1.26.0"
+          go-version: "^1.26.4"
 
       - name: Install frontend dependencies
         working-directory: ./frontend
@@ -112,7 +112,7 @@ jobs:
       - name: Install go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
-          go-version: "^1.26.0"
+          go-version: "^1.26.4"
 
       - name: Install frontend dependencies
         working-directory: ./frontend

.github/workflows/release.yml

@@ -43,7 +43,7 @@ jobs:
       - name: Install go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
-          go-version: "^1.26.0"
+          go-version: "^1.26.4"
 
       - name: Install frontend dependencies
         working-directory: ./frontend
@@ -85,7 +85,7 @@ jobs:
       - name: Install go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
-          go-version: "^1.26.0"
+          go-version: "^1.26.4"
 
       - name: Install frontend dependencies
         working-directory: ./frontend

.github/workflows/scorecard.yml

@@ -38,6 +38,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        uses: github/codeql-action/upload-sarif@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4
         with:
           sarif_file: results.sarif

CONTRIBUTING.md

@@ -8,7 +8,7 @@ Contributing to Tinyauth is straightforward. Follow the steps below to set up a
 ## Requirements
 
 - pnpm
-- Golang v1.24.0 or later
+- Golang v1.26.4 or later
 - Git
 - Docker
 - Make

internal/model/config.go

@@ -178,15 +178,16 @@ type UIConfig struct {
 }
 
 type LDAPConfig struct {
-	Address       string `description:"LDAP server address." yaml:"address"`
+	Address      	 string `description:"LDAP server address." yaml:"address"`
-	BindDN        string `description:"Bind DN for LDAP authentication." yaml:"bindDn"`
+	BindDN       	 string `description:"Bind DN for LDAP authentication." yaml:"bindDn"`
-	BindPassword  string `description:"Bind password for LDAP authentication." yaml:"bindPassword"`
+	BindPassword  	 string `description:"Bind password for LDAP authentication." yaml:"bindPassword"`
-	BaseDN        string `description:"Base DN for LDAP searches." yaml:"baseDn"`
+	BindPasswordFile string `description:"Path to the Bind password." yaml:"bindPasswordFile"`
-	Insecure      bool   `description:"Allow insecure LDAP connections." yaml:"insecure"`
+	BaseDN       	 string `description:"Base DN for LDAP searches." yaml:"baseDn"`
-	SearchFilter  string `description:"LDAP search filter." yaml:"searchFilter"`
+	Insecure     	 bool   `description:"Allow insecure LDAP connections." yaml:"insecure"`
-	AuthCert      string `description:"Certificate for mTLS authentication." yaml:"authCert"`
+	SearchFilter 	 string `description:"LDAP search filter." yaml:"searchFilter"`
-	AuthKey       string `description:"Certificate key for mTLS authentication." yaml:"authKey"`
+	AuthCert     	 string `description:"Certificate for mTLS authentication." yaml:"authCert"`
-	GroupCacheTTL int    `description:"Cache duration for LDAP group membership in seconds." yaml:"groupCacheTTL"`
+	AuthKey      	 string `description:"Certificate key for mTLS authentication." yaml:"authKey"`
+	GroupCacheTTL	 int    `description:"Cache duration for LDAP group membership in seconds." yaml:"groupCacheTTL"`
 }
 
 type LogConfig struct {

internal/service/ldap_service.go

@@ -11,6 +11,7 @@ import (
 	ldapgo "github.com/go-ldap/ldap/v3"
 	"github.com/steveiliop56/ding"
 	"github.com/tinyauthapp/tinyauth/internal/model"
+	"github.com/tinyauthapp/tinyauth/internal/utils"
 	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
 )
 
@@ -32,6 +33,10 @@ func NewLdapService(
 		return nil, nil
 	}
 
+	secret := utils.GetSecret(config.LDAP.BindPassword, config.LDAP.BindPasswordFile)
+	config.LDAP.BindPassword = secret
+	config.LDAP.BindPasswordFile = ""
+
 	ldap := &LdapService{
 		log:    log,
 		config: config,