Configure admin service account from environment variable

[SamGeens]

What problem is this solving

Currently the environment variable needs to be configured be adding the file name of the service account. This obligates the developer to store those secret credentials in code. Being able to configure the admin setting from string (or environment variable) would solve this.

Proposed solution

Allow the following configuration:

admin: { serviceAccount: JSON.parse(process.env.FIREBASE_SERVICE_ACCOUNT), },

Describe alternatives you've considered

Adding the admin module directly within the Firebase configuration

[posva]

Right now it allows for a path to the credential files. It would be nice to support both thought

[akodkod]

Based on type annotations you can specify serviceAccount as an object.

[chrisspiegl]

Based on the code, the environment variable method is already supported: https://github.com/vuejs/vuefire/search?q=GOOGLE_APPLICATION_CREDENTIALS

This way you just specify the env variable GOOGLE_APPLICATION_CREDENTIALS to be the path to your credentials and you're good to go. No need to set the serviceAccount property in the nuxt.config.ts file.

GOOGLE_APPLICATION_CREDENTIALS=./.firebase-service-account.staging.json

I am still in the process of testing if the GOOGLE_APPLICATION_CREDENTIALS env variable is set on Firebase or not, but if it is, that'd be pretty nice way of doing this.

[dosstx]

Thanks that is good to know, @chrisspiegl . I'll also check on that.

[tux2nicolae]

I encounter the same problem, I'm deploying my web app in AWS ECS and it's not that easy for us deploy the firebase.json file inside the container during our build setup, is there a way to provide the configuration as an environment variable?

[chrisspiegl]

@tux2nicolae You can always put stuff into Environment variables and then use those at build time via process.env.FIREBASE_{…}. Alternatively you can also put the firebase.json files into the repo since they are deployed client side anyways — from my understanding. Just the Google Service Account… that's something that should never end up in a repo and should always be put into environment variables.

[tux2nicolae]

@chrisspiegl thank you for your fast replay, really appreciate it

Unfortunately I can't put the file in repo for security concerns, we are using the nuxt module so we expect that this file won't reach the client side.

Regarding the environment variables could you elaborate please? I've tried to set FIREBASE_CONFIG with the json data, but the deployment would fail because it expects the configuration file to be present on disk.

Please advise me if I'm missing anything, thx

[chrisspiegl]

@tux2nicolae I am using Nuxt as well. And I am doing it as follows:

vuefire: {
    config: JSON.parse(process.env.FIREBASE_CONFIG)
}

And set the FIREBASE_CONFIG with the whole sdkConfig JSON String.

Alternatively you can also do:

vuefire: {
    config: {
      projectId: process.env.FIREBASE_PROJECT_ID,
      appId: process.env.FIREBASE_APP_ID,
      apiKey: process.env.FIREBASE_API_KEY,
      messagingSenderId: process.env.FIREBASE_MESSAGING_SENDER_ID,
    }
}

And set the values in the ENV individually.

[tux2nicolae]

@chrisspiegl thank you, indeed this solves the problem with firebase config, but I think the problem remains with the Google Service Account which apparently can't be provided via environment variables, did you manage to set google service account as well?

[chrisspiegl]

@tux2nicolae At this time, I was only able to provide a path to the Google Services Account via GOOGLE_APPLICATION_CREDENTIALS = ./.firebase-service-account.json… So, the credentials are still stored in a file.

For me, it doesn't matter because I am running the cloud functions on firebase functions 🙈. But, you mentioned, that you are on AWS so that's a bit of a different situation.

I did some quick researching and found that you can setup some IAM auth service thing and that should do the trick for you — while staying secure and not having to store keys in your code:

https://dwdraju.medium.com/calling-google-cloud-services-from-aws-using-iam-roles-without-gcp-service-account-credentials-af918c05384d

[tux2nicolae]

Thank you again for your research, very valuable information, I'll give it a try, thank you!

[robokozo]

I'm experiencing the same situation where I need to provide the vuefire.admin.serviceAccount but it fails on deployment because the file isn't deployed with the rest of the app. Not sure how to move forward.

I tried filling out the info that @akodkod pointed out but not having luck with this approach either.

Is there a way to have nuxt copy the file when it does a build (but not expose it publicly)?

[noook]

Regarding the service account, is it accessible to contribute ? I searched through the code in the nuxt package but it doesn't seem to be used anywhere in it. My guess is it just sets the environment variable for vuefire afterwards.

My result is based on this search:

 WARN  [nuxt-vuefire]: You activated both SSR and auth but you are not providing an admin config. If you render or prerender any page using auth, you will get an error. In that case, provide an admin config to the nuxt-vuefire module.

I'm deploying on Vercel and my sessions can't be persisted / shared on the server because of that

[chrisspiegl]

I was able to get the Service Account into ENV variables.

It's actually already possible based on ENV variables based on the below code. But there is a small quirk which needs to be set so it works. May be something to update the docs about.

The way it works is of based on these lines:

vuefire/packages/nuxt/src/runtime/admin/plugin.server.ts

Lines 23 to 33 in 83f4e09

	if (!getApps().length) {
	const {
	// these can be set by the user on other platforms
	FIREBASE_PROJECT_ID,
	FIREBASE_CLIENT_EMAIL,
	FIREBASE_PRIVATE_KEY,
	// set on firebase cloud functions
	FIREBASE_CONFIG,
	// in cloud functions, we can auto initialize
	FUNCTION_NAME,
	} = process.env

The setup works as follows:

• The script expects that the GOOGLE_APPLICATION_CREDENTIALS must be present. Not sure why because it is not the only way to set the service account and it can actually be anything. It just can not be undefiend.
• When you do not provide GOOGLE_APPLICATION_CREDENTIALS it gives the error:

[nuxt-vuefire]: You activated both SSR and auth but you are not providing an admin config. If you render or prerender any page using auth, you will get an error. In that case, provide an admin config to the nuxt-vuefire module.

• You can however, provide the service account via three additional ENV variables FIREBASE_PROJECT_ID, FIREBASE_CLIENT_EMAIL, and FIREBASE_PRIVATE_KEY
• I was able to test this and it worked.
• When setting the GOOGLE_APPLICATION_CREDENTIALS=TEST and the other three to their respective values, I got the following log message — and most importantly: SSR did work perfectly.

[nuxt-vuefire]: using FIREBASE_PRIVATE_KEY env variable

There are another two variables (FIREBASE_CONFIG and FUNCTION_NAME). As far as I understand, these are used when deploying directly to Google Firebase Functions and should not necessarily be used by us manually. (Docs)

Your .ENV config file needs to include:

# VUEFIRE Firebase Authentication Service Account (path if using it, something random if you want to use the below config cause it needs to be defined even if you don't use it).
GOOGLE_APPLICATION_CREDENTIALS = "TEST"

# These can be set by the user on other platforms
FIREBASE_PROJECT_ID = your-project-id
FIREBASE_CLIENT_EMAIL = firebase-adminsdk-xxxxxx@your-project-id.iam.gserviceaccount.com
FIREBASE_PRIVATE_KEY = "-----BEGIN PRIVATE KEY-----XXXXXXXXXXXXX-----END PRIVATE KEY-----\n"