problem: need to setup upstream auth w/o storing passwords in config

solution: use environment variable placeholders

src/main/kotlin/io/emeraldpay/dshackle/config/UpstreamsConfigReader.kt

@@ -16,6 +16,7 @@ import java.net.URI
 class UpstreamsConfigReader {
 
     private val log = LoggerFactory.getLogger(UpstreamsConfigReader::class.java)
+    private val envRegex = Regex("\\$\\{(\\w+?)}")
 
     fun read(input: InputStream): UpstreamsConfig {
         val yaml = Yaml()
@@ -198,12 +199,13 @@ class UpstreamsConfigReader {
     private fun getListOfString(mappingNode: MappingNode?, key: String): List<String>? {
         return getList<ScalarNode>(mappingNode, key)?.value
                 ?.map { it.value }
+                ?.map(this::postProcess)
     }
 
     private fun getValueAsString(mappingNode: MappingNode?, key: String): String? {
         return getValue(mappingNode, key)?.let {
              return@let it.value
-        }
+        }?.let(this::postProcess)
     }
 
     private fun getValueAsInt(mappingNode: MappingNode?, key: String): Int? {
@@ -233,4 +235,12 @@ class UpstreamsConfigReader {
             throw IllegalArgumentException("Not a map")
         }
     }
+
+    fun postProcess(value: String): String {
+        return envRegex.replace(value) { m ->
+            m.groups[1]?.let { g ->
+                System.getProperty(g.value) ?: System.getenv(g.value) ?: ""
+            } ?: ""
+        }
+    }
 }

src/test/groovy/io/emeraldpay/dshackle/config/UpstreamsConfigReaderSpec.groovy

@@ -95,4 +95,26 @@ class UpstreamsConfigReaderSpec extends Specification {
             labels["api"] == "geth"
         }
     }
+
+    def "Post process for usual strings"() {
+        expect:
+        s == reader.postProcess(s)
+        where:
+        s << ["", "a", "13143", "/etc/client1.myservice.com.key", "true", "1a68f20154fc258fe4149c199ad8f281"]
+    }
+
+    def "Post process replaces from env"() {
+        setup:
+        System.setProperty("id", "1")
+        System.setProperty("HOME", "/home/user")
+        System.setProperty("PASSWORD", "1a68f20154fc258fe4149c199ad8f281")
+        expect:
+        replaced == reader.postProcess(orig)
+        where:
+        orig                | replaced
+        "p_\${id}"          | "p_1"
+        "home: \${HOME}"    | "home: /home/user"
+        "\${PASSWORD}"      | "1a68f20154fc258fe4149c199ad8f281"
+    }
+
 }