use secretfile

Cargo.lock

@@ -1170,6 +1170,7 @@ dependencies = [
  "prometheus-edge-detector",
  "reqwest",
  "rumqttc",
+ "secretfile",
  "serde",
  "serde_json",
  "thiserror",
@@ -1407,6 +1408,15 @@ dependencies = [
  "untrusted",
 ]
 
+[[package]]
+name = "secretfile"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "746c54b939ab8d393b536765393c0bd7634fca94eed62321ec3e3559293f6c21"
+dependencies = [
+ "thiserror",
+]
+
 [[package]]
 name = "security-framework"
 version = "2.9.2"

Cargo.toml

@@ -20,6 +20,7 @@ thiserror = "1.0.57"
 serde_json = "1.0.113"
 rumqttc = "0.23.0"
 hostname = "0.3.1"
+secretfile = "0.1.0"
 
 [dev-dependencies]
 maplit = "1.0.2"

src/config.rs

@@ -1,8 +1,8 @@
 use crate::mdns::resolve_mdns;
+use secretfile::{load, SecretError};
 use serde::Deserialize;
 use std::collections::HashMap;
 use std::convert::TryFrom;
-use std::fs::read_to_string;
 use thiserror::Error;
 
 #[derive(Debug, Error)]
@@ -122,14 +122,12 @@ pub enum MqttPassword {
 }
 
 impl TryFrom<RawMqttConfig> for MqttConfig {
-    type Error = std::io::Error;
+    type Error = SecretError;
 
     fn try_from(value: RawMqttConfig) -> Result<Self, Self::Error> {
         let password = match value.password {
             Some(MqttPassword::Raw { password }) => Some(password),
-            Some(MqttPassword::File { password_file }) => {
-                Some(read_to_string(password_file)?.trim().to_string())
-            }
+            Some(MqttPassword::File { password_file }) => Some(load(&password_file)?),
             None => None,
         };
         Ok(MqttConfig {