pass admin token through an env var

warpgate/src/commands/run.rs

@@ -16,10 +16,17 @@ use warpgate_protocol_ssh::SSHProtocolServer;
 
 use crate::config::{load_config, watch_config};
 
-pub(crate) async fn command(cli: &crate::Cli, admin_token: Option<String>) -> Result<()> {
+pub(crate) async fn command(cli: &crate::Cli, enable_admin_token: bool) -> Result<()> {
     let version = env!("CARGO_PKG_VERSION");
     info!(%version, "Warpgate");
 
+    let admin_token = enable_admin_token.then(|| {
+        std::env::var("WARPGATE_ADMIN_TOKEN").unwrap_or_else(|_| {
+            error!("`WARPGATE_ADMIN_TOKEN` env variable must set when using --enable-admin-token");
+            std::process::exit(1);
+        })
+    });
+
     let config = load_config(&cli.config, true)?;
     let services = Services::new(config.clone(), admin_token).await?;
 

warpgate/src/main.rs

@@ -71,9 +71,9 @@ pub(crate) enum Commands {
     ClientKeys,
     /// Run Warpgate
     Run {
-        /// An API token that automatically maps to the first admin user
-        #[clap(long)]
-        admin_token: Option<String>,
+        /// Enable an API token (passed via the `WARPGATE_ADMIN_TOKEN` env var) that automatically maps to the first admin user
+        #[clap(long, action=ArgAction::SetTrue)]
+        enable_admin_token: bool,
     },
     /// Create a password hash for use in the config file
     Check,
@@ -95,8 +95,8 @@ async fn _main() -> Result<()> {
     init_logging(load_config(&cli.config, false).ok().as_ref(), &cli).await;
 
     match &cli.command {
-        Commands::Run { admin_token } => {
-            crate::commands::run::command(&cli, admin_token.clone()).await
+        Commands::Run { enable_admin_token } => {
+            crate::commands::run::command(&cli, *enable_admin_token).await
         }
         Commands::Check => crate::commands::check::command(&cli).await,
         Commands::TestTarget { target_name } => {