Adds a new command line for tunnel run for token file

[Cyb3r-Jak3]

Adds a new command line flag for tunnel run which allows a file to be read for the token. I've left the token command line argument with priority.

Would resolve #645

[janani-cr]

@Cyb3r-Jak3 Can you please elaborate on your need to store the tunnel token in a local file? Any details of your workflow would be helpful.

[Cyb3r-Jak3]

@janani-cr The goal would be to use docker secrets to pass the token to cloudflared. Docker secrets are passed as a file to the container. Standard practice for other images to have _FILE suffix so secrets can be used.

[rakino]

This feature is also desired for running cloudflared on Guix System or NixOS, since service definitions are done at build time and written to the store which is world-readable.

Only specifying path to a keyfile outside the store can avoid the token being included in it.

[masonfx]

This would be great to get merged. I've been looking for a more user-friendly (see: not a workaround) way to provide the tunnel token as a Docker secret.

[KalenWessel]

Would love to see this released soon. All of my other services are able to use the _FILE convention with docker secrets. Cloudflare tunnel is the last service holding out on me.

[david-plugge]

Yes please!

[lazysegtree]

@Cyb3r-Jak3 I have another concern about this. os.ReadFile reads the entire file into the memory, so should there be some sort of check on file size before reading the entire file ? (Maybe user passed a very big file with size in GBs by mistake.)
We could use os.Stat to get FileInfo object, and FileInfo.Size() to get file size, and apply a size check ( maybe limit files to < 10 MB )

• https://pkg.go.dev/os#File.Stat
• https://pkg.go.dev/io/fs#FileInfo

Not sure if this is needed or not.

[Cyb3r-Jak3]

@Cyb3r-Jak3 I have another concern about this. os.ReadFile reads the entire file into the memory, so should there be some sort of check on file size before reading the entire file ?

I thought about this, but the config isn't checked for size, I didn't add it here.