Supplement docker secrets usage information

Docker secrets has a couple of characteristics that may cause baffling
errors where configuration looks correct but the pihole container cannot
read the secret. The UID and GID of the secret file on the host must be
set to the same value used by the pihole process in the container
(typically 1000).
Signed-off-by: Bradley G Smith <[email protected]>

Author: buckaroogeek

README.md

@@ -144,7 +144,7 @@ If this variable is not detected and you have not already set one via `pihole se
 | `FTLCONF_[SETTING]` | unset | As per documentation | Customize pihole.toml with settings described in the [API Documentation](https://docs.pi-hole.net/api).<br><br>Replace `.` with `_`, e.g for `dns.dnssec=true` use `FTLCONF_dns_dnssec: 'true'`.<br/>Array type configs should be delimited with `;`.|
 | `PIHOLE_UID` | `1000` | Number | Overrides image's default pihole user id to match a host user id.<br/>**IMPORTANT**: id must not already be in use inside the container!|
 | `PIHOLE_GID` | `1000` | Number | Overrides image's default pihole group id to match a host group id.<br/>**IMPORTANT**: id must not already be in use inside the container!|
-| `WEBPASSWORD_FILE` | unset| `<Docker secret file>` | Set an Admin password using [Docker secrets](https://docs.docker.com/engine/swarm/secrets/). If `FTLCONF_webserver_api_password` is set, `WEBPASSWORD_FILE` is ignored. If `FTLCONF_webserver_api_password` is empty, and `WEBPASSWORD_FILE` is set to a valid readable file, then `FTLCONF_webserver_api_password` will be set to the contents of `WEBPASSWORD_FILE`. |
+| `WEBPASSWORD_FILE` | unset| `<Docker secret file>` | Set an Admin password using Docker secrets with [Swarm](https://docs.docker.com/engine/swarm/secrets/) or [Compose](https://docs.docker.com/compose/how-tos/use-secrets/). If `FTLCONF_webserver_api_password` is set, `WEBPASSWORD_FILE` is ignored. If `FTLCONF_webserver_api_password` is empty, and `WEBPASSWORD_FILE` is set to a valid readable file, then `FTLCONF_webserver_api_password` will be set to the contents of `WEBPASSWORD_FILE`. **IMPORTANT**: see Docker secrets in Tips and Tricks below.|
 
 ### Advanced Variables
 
@@ -182,6 +182,15 @@ Here is a rundown of other arguments for your docker-compose / docker run.
     - **Note:** This only applies to web interface ports (80 and 443). DNS (53), DHCP (67), and NTP (123) ports must still be handled via Docker port mappings or host networking.
 - Docker's default network mode `bridge` isolates the container from the host's network. This is a more secure setting, but requires setting the Pi-hole DNS option for _Interface listening behavior_ to "Listen on all interfaces, permit all origins".
 - If you're using a Red Hat based distribution with an SELinux Enforcing policy, add `:z` to line with volumes.
+- If using Docker Secrets to set the web admin password with a file, keep in mind that:
+  1. The secret file is mounted as a read-only volume in the container;
+  1. Permissions are set to user read-only;
+  1. The user and group ID (UID and GID) for the file on the Docker host are retained in the container. The UID and GID for the file **must** be identical to the Pi-Hole user (typically 1000) otherwise the `pihole` process cannot read the secret and a random password will be set. On the host do something like:
+  ``` bash
+  # secret file is webpass.txt; default pihole UID of 1000 is used
+  sudo chown 1000:1000 webpass.txt
+  sudo chmod 0400 webpass.txt
+  ```
 
 ### Installing on Ubuntu or Fedora