use certs as secrets

docker-compose.base.ops.yml

@@ -31,6 +31,11 @@ services:
       - shib-extnet
   shibauth:
     image: testing-shibboleth
+    environment:
+      APACHE_SERVERNAME: "https://emg.pdas.prism.eox.at:443"
+    secrets:
+      - SHIB_CERT
+      - SHIB_KEY
     deploy:
       replicas: 1
       placement:
@@ -67,3 +72,8 @@ networks:
     name: logging-extnet
   shib-extnet:
     name: shib-extnet
+secrets:
+  SHIB_CERT:
+    external: true
+  SHIB_KEY:
+    external: true

shibauth/shibboleth-conf/shibboleth2.xml

@@ -23,7 +23,7 @@
         <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
         <AttributeResolver type="Query" subjectMatch="true"/>
         <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
-        <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
+        <CredentialResolver type="File" key="/run/secrets/SHIB_KEY" certificate="/run/secrets/SHIB_CERT"/>
     </ApplicationDefaults>
     <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
     <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>