add INIT_PASSWORD_FILE option

docs/content/advanced/config/unattended-setup.md

@@ -10,7 +10,7 @@ These will only be used during the first start of the container. After that, the
 | ------------------ | ---------------------------- | --------------------------------------------------------- | ----- |
 | `INIT_ENABLED`     | `true`                       | Enables the below env vars                                | 0     |
 | `INIT_USERNAME`    | `admin`                      | Sets admin username                                       | 1     |
-| `INIT_PASSWORD`    | `Se!ureP%ssw`                | Sets admin password                                       | 1     |
+| `INIT_PASSWORD`    | `Se!ureP%ssw`                | Sets admin password (or `INIT_PASSWORD_FILE`)             | 1     |
 | `INIT_HOST`        | `vpn.example.com`            | Host clients will connect to                              | 1     |
 | `INIT_PORT`        | `51820`                      | Port clients will connect to and wireguard will listen on | 1     |
 | `INIT_DNS`         | `1.1.1.1,8.8.8.8`            | Sets global dns setting                                   | 2     |

src/server/utils/config.ts

@@ -1,5 +1,6 @@
 import debug from 'debug';
 import packageJson from '@@/package.json';
+import fs from 'fs';
 
 export const RELEASE = 'v' + packageJson.version;
 
@@ -31,10 +32,14 @@ export const WG_ENV = {
   EXPERIMENTAL_AWG: process.env.EXPERIMENTAL_AWG === 'true',
 };
 
+const PASSWORD = process.env.INIT_PASSWORD_FILE?.length > 0 ?
+  fs.readFileSync(process.env.INIT_PASSWORD_FILE, 'utf-8').trim() :
+  process.env.INIT_PASSWORD;
+
 export const WG_INITIAL_ENV = {
   ENABLED: process.env.INIT_ENABLED === 'true',
   USERNAME: process.env.INIT_USERNAME,
-  PASSWORD: process.env.INIT_PASSWORD,
+  PASSWORD,
   DNS: process.env.INIT_DNS?.split(',').map((x) => x.trim()),
   IPV4_CIDR: process.env.INIT_IPV4_CIDR,
   IPV6_CIDR: process.env.INIT_IPV6_CIDR,