entrypoint/: let Icinga Web render its config files, not a Go lib by Al2Klimov · Pull Request #123 · Icinga/docker-icingaweb2

Al2Klimov · 2024-04-19T11:23:40Z

It knows best what they have to look like to be interpreted correctly. Especially the proper quoting of special characters is important.

closes #119
closes lippserd/docker-compose-icinga#39

Before

[Administrators]
permissions = *
users       = icingaadmin
groups      = Administrators

After

[Administrators]
groups = "Administrators"
permissions = "*"
users = "icingaadmin"

Al2Klimov · 2026-10-30T09:16:38Z

Please have a look!

lippserd

Existing manual INI-quoting workarounds change meaning with this serializer. An environment value containing the literal bytes "secret" previously produced secret when read, but now retains the outer quote characters. The same applies to LDAP DNs such as "dc=example,dc=com".

Since this change will reach existing users without a separate release, add ICINGAWEB_SERIALIZER_COMPAT to preserve existing quoting workarounds during the transition. Default it to 1 before Icinga Web 2.15.0. In compatibility mode, strip exactly one matching pair of outer double quotes from environment-derived configuration values without trimming other characters. Allow 0 to preserve values literally, including intentional surrounding quotes. Starting with 2.15.0, default it to 0 while temporarily retaining explicit opt-in.

Warn whenever compatibility mode transforms a value. Identify the setting but never log its value, since it may contain credentials. Explain that users should remove the embedded INI quotes and disable compatibility before the default changes. Verify quoted values containing escaped quotes and backslashes too, since stripping outer quotes alone may not reproduce their previous interpretation.

Please also document the compatibility flag and transition in README.md's environment-variable section and migration guidance. Distinguish embedded INI quote characters from shell/YAML quoting, which users should retain where needed. Update the generated INI example to show the quoted output. In the same section, document the known limitation that Icinga Web's renderer strips leading and trailing whitespace from values, including passwords.

As another nonblocking follow-up, put the literal entrypoint/ directory in backticks in commit 05c135f's subject.

Al2Klimov · 2026-11-10T16:43:04Z

I did it my way. :-) Let me know what you think about it!

Test

podman run --rm -ite icingaweb_authentication_lolcat_password="$(python3 -c 'print("".join(map(chr, range(32, 127))))')" icinga/icingaweb2:test find /etc/icingaweb2/
[Tue Nov 10 16:40:45.951669348 2026] [docker_entrypoint:info] [pid 1] DOCKERE: Initializing /data as we're the init process
[Tue Nov 10 16:40:45.951724996 2026] [docker_entrypoint:debug] [pid 1] DOCKERE: Creating "/data/etc/icingaweb2/enabledModules"
[Tue Nov 10 16:40:45.951811486 2026] [docker_entrypoint:debug] [pid 1] DOCKERE: Creating "/data/var/lib/icingaweb2"
[Tue Nov 10 16:40:45.95184218 2026] [docker_entrypoint:debug] [pid 1] DOCKERE: Translating env vars to .ini config
[Tue Nov 10 16:40:45.953458352 2026] [docker_entrypoint:trace1] [pid 1] DOCKERE: Writing "authentication.ini"
[Tue Nov 10 16:40:46.299075541 2026] [docker_entrypoint:warn] [pid 1] DOCKERE: Icinga Web would interpret option "password" in section "lolcat" of "authentication.ini" differently with v2.15 or ICINGAWEB_SERIALIZER_COMPAT=0:
- "" **********************************************************************************************""
+ **********************************************************************************************
[Tue Nov 10 16:40:46.29956981 2026] [docker_entrypoint:info] [pid 1] DOCKERE: Checking database resources used as backends
[Tue Nov 10 16:40:46.351164357 2026] [docker_entrypoint:info] [pid 1] DOCKERE: Looking up "find" in $PATH
[Tue Nov 10 16:40:46.351209507 2026] [docker_entrypoint:info] [pid 1] DOCKERE: Running "/usr/bin/find"
/etc/icingaweb2/
/etc/icingaweb2/authentication.ini
/etc/icingaweb2/enabledModules

Al2Klimov · 2026-11-10T16:51:14Z

Test

With and without ICINGAWEB_SERIALIZER_COMPAT=0:

[aklimov@ws-aklimov:~/WS/docker-icingaweb2]$ podman run --rm -ite icingaweb_authentication_lolcat_password="$(python3 -c 'print("".join(map(chr, range(32, 127))))')" icinga/icingaweb2:test cat /etc/icingaweb2/authentication.ini
[Tue Nov 10 16:49:44.123733999 2026] [docker_entrypoint:info] [pid 1] DOCKERE: Initializing /data as we're the init process
[Tue Nov 10 16:49:44.123821482 2026] [docker_entrypoint:debug] [pid 1] DOCKERE: Creating "/data/etc/icingaweb2/enabledModules"
[Tue Nov 10 16:49:44.123982077 2026] [docker_entrypoint:debug] [pid 1] DOCKERE: Creating "/data/var/lib/icingaweb2"
[Tue Nov 10 16:49:44.124046705 2026] [docker_entrypoint:debug] [pid 1] DOCKERE: Translating env vars to .ini config
[Tue Nov 10 16:49:44.124217494 2026] [docker_entrypoint:trace1] [pid 1] DOCKERE: Writing "authentication.ini"
[Tue Nov 10 16:49:44.275850855 2026] [docker_entrypoint:warn] [pid 1] DOCKERE: Icinga Web would interpret option "password" in section "lolcat" of "authentication.ini" differently with ICINGAWEB_SERIALIZER_COMPAT=0:
- "" **********************************************************************************************""
+ **********************************************************************************************
[Tue Nov 10 16:49:44.276289508 2026] [docker_entrypoint:info] [pid 1] DOCKERE: Checking database resources used as backends
[Tue Nov 10 16:49:44.326687509 2026] [docker_entrypoint:info] [pid 1] DOCKERE: Looking up "cat" in $PATH
[Tue Nov 10 16:49:44.331018268 2026] [docker_entrypoint:info] [pid 1] DOCKERE: Running "/usr/bin/cat"
[lolcat]
password = """ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~"""

[aklimov@ws-aklimov:~/WS/docker-icingaweb2]$ podman run --rm -ite icingaweb_authentication_lolcat_password="$(python3 -c 'print("".join(map(chr, range(32, 127))))')" -e ICINGAWEB_SERIALIZER_COMPAT=0 icinga/icingaweb2:test cat /etc/icingaweb2/authentication.ini
[Tue Nov 10 16:50:12.255084291 2026] [docker_entrypoint:info] [pid 1] DOCKERE: Initializing /data as we're the init process
[Tue Nov 10 16:50:12.255166926 2026] [docker_entrypoint:debug] [pid 1] DOCKERE: Creating "/data/etc/icingaweb2/enabledModules"
[Tue Nov 10 16:50:12.255307978 2026] [docker_entrypoint:debug] [pid 1] DOCKERE: Creating "/data/var/lib/icingaweb2"
[Tue Nov 10 16:50:12.255378769 2026] [docker_entrypoint:debug] [pid 1] DOCKERE: Translating env vars to .ini config
[Tue Nov 10 16:50:12.255537259 2026] [docker_entrypoint:trace1] [pid 1] DOCKERE: Writing "authentication.ini"
[Tue Nov 10 16:50:12.309670634 2026] [docker_entrypoint:info] [pid 1] DOCKERE: Checking database resources used as backends
[Tue Nov 10 16:50:12.359407802 2026] [docker_entrypoint:info] [pid 1] DOCKERE: Looking up "cat" in $PATH
[Tue Nov 10 16:50:12.359471559 2026] [docker_entrypoint:info] [pid 1] DOCKERE: Running "/usr/bin/cat"
[lolcat]
password = "!\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~"

[aklimov@ws-aklimov:~/WS/docker-icingaweb2]$

It knows best what they have to look like to be interpreted correctly. Especially the proper quoting of special characters is important.

…ring Render the config both via Icinga Web and the old way via go-ini and install the latter if ICINGAWEB_SERIALIZER_COMPAT=1. Unless set, it defaults to 0 as of Icinga Web v2.15.0 and to 1 for older versions. This way, rebuilds of older releases don't change their behavior.

If ICINGAWEB_SERIALIZER_COMPAT is effectively 1, let Icinga Web parse both the old and the new rendering of each config file and warn about every option which has a different value in the new one.

Co-authored-by: Eric Lippmann <eric.lippmann@icinga.com>

Al2Klimov added bug Something isn't working go Pull requests that update Go code labels Apr 19, 2024

cla-bot Bot added the cla/signed label Apr 19, 2024

Al2Klimov mentioned this pull request Jul 9, 2024

Update README.md #119

Closed

adn77 mentioned this pull request Nov 12, 2025

Re-build image on new mod versions #122

Open

Al2Klimov requested a review from nilmerg August 13, 2026 10:17

Al2Klimov assigned nilmerg Aug 21, 2026

lippserd requested changes Nov 10, 2026

View reviewed changes

Comment thread entrypoint/main.go Resolved

Comment thread entrypoint/main.go Resolved

Comment thread entrypoint/main.go Resolved

Comment thread entrypoint/db-init/application/clicommands/ConfigCommand.php Resolved

Al2Klimov removed the request for review from nilmerg November 10, 2026 11:43

Al2Klimov unassigned nilmerg Nov 10, 2026

Al2Klimov marked this pull request as draft November 10, 2026 11:43

Al2Klimov force-pushed the env-ini branch 4 times, most recently from d8f4f37 to fbcf15e Compare November 10, 2026 16:40

Al2Klimov marked this pull request as ready for review November 10, 2026 16:49

lippserd requested changes Nov 11, 2026

View reviewed changes

Comment thread entrypoint/config.go Resolved

Comment thread entrypoint/config.go Resolved

Al2Klimov added 4 commits November 11, 2026 12:08

entrypoint/: let Icinga Web render its config files, not a Go lib

9fea271

It knows best what they have to look like to be interpreted correctly. Especially the proper quoting of special characters is important.

entrypoint/: warn about options interpreted differently w/o compat

6afafaf

If ICINGAWEB_SERIALIZER_COMPAT is effectively 1, let Icinga Web parse both the old and the new rendering of each config file and warn about every option which has a different value in the new one.

Document ICINGAWEB_SERIALIZER_COMPAT and the migration to 0

db85b22

Al2Klimov force-pushed the env-ini branch from bb27c73 to db85b22 Compare November 11, 2026 11:32

Al2Klimov requested a review from lippserd November 11, 2026 11:33

lippserd requested changes Nov 11, 2026

View reviewed changes

Comment thread entrypoint/db-init/application/clicommands/ConfigCommand.php Resolved

Comment thread entrypoint/config.go Resolved

Apply batched suggestions from code review

78be81b

Co-authored-by: Eric Lippmann <eric.lippmann@icinga.com>

Al2Klimov requested a review from lippserd November 11, 2026 14:12

lippserd approved these changes Nov 11, 2026

View reviewed changes

Al2Klimov merged commit 47a4f8a into master Nov 11, 2026
2 of 5 checks passed

Al2Klimov deleted the env-ini branch November 11, 2026 15:07

Navigation Menu

Repository navigation

entrypoint/: let Icinga Web render its config files, not a Go lib - #123

entrypoint/: let Icinga Web render its config files, not a Go lib#123
Al2Klimov merged 5 commits into
masterfrom
env-ini

Al2Klimov commented Apr 19, 2024 •

edited

Loading

Uh oh!

Al2Klimov commented Oct 30, 2026

Uh oh!

lippserd left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Al2Klimov commented Nov 10, 2026

Uh oh!

Al2Klimov commented Nov 10, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Al2Klimov commented Apr 19, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Before

After

Uh oh!

Al2Klimov commented Oct 30, 2026

Uh oh!

lippserd left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Al2Klimov commented Nov 10, 2026

Test

Uh oh!

Al2Klimov commented Nov 10, 2026

Test

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Al2Klimov commented Apr 19, 2024 •

edited

Loading