63 lines
2.0 KiB
Bash
Executable File
63 lines
2.0 KiB
Bash
Executable File
#!/bin/bash
|
|
#
|
|
# Phase 8: Secrets Configuration
|
|
# Store deployment secrets in a local operator-controlled env file.
|
|
#
|
|
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
source "${SCRIPT_DIR}/config.sh"
|
|
|
|
log_info "=========================================="
|
|
log_info "Phase 8: Secrets Configuration"
|
|
log_info "=========================================="
|
|
|
|
SECRETS_DIR="${STATE_DIR}/secrets"
|
|
SECRETS_FILE="${SECRETS_DIR}/${ENVIRONMENT}.env"
|
|
|
|
log_step "8.1 Preparing local secrets file..."
|
|
mkdir -p "${SECRETS_DIR}"
|
|
|
|
if [ ! -f "${SECRETS_FILE}" ]; then
|
|
touch "${SECRETS_FILE}"
|
|
chmod 600 "${SECRETS_FILE}"
|
|
log_success "Created ${SECRETS_FILE}"
|
|
else
|
|
chmod 600 "${SECRETS_FILE}"
|
|
log_success "Using existing ${SECRETS_FILE}"
|
|
fi
|
|
|
|
log_step "8.2 Writing known secrets..."
|
|
if [ -n "${DATABASE_URL:-}" ] && ! grep -q '^DATABASE_URL=' "${SECRETS_FILE}" 2>/dev/null; then
|
|
printf 'DATABASE_URL=%s\n' "${DATABASE_URL}" >> "${SECRETS_FILE}"
|
|
log_success "Stored DATABASE_URL in ${SECRETS_FILE}"
|
|
fi
|
|
|
|
if ! grep -q '^JWT_SECRET=' "${SECRETS_FILE}" 2>/dev/null; then
|
|
JWT_SECRET=$(openssl rand -base64 32)
|
|
printf 'JWT_SECRET=%s\n' "${JWT_SECRET}" >> "${SECRETS_FILE}"
|
|
log_success "Generated JWT_SECRET in ${SECRETS_FILE}"
|
|
else
|
|
log_success "JWT_SECRET already present in ${SECRETS_FILE}"
|
|
fi
|
|
|
|
log_step "8.3 Checking identity provider placeholders..."
|
|
for key in OIDC_ISSUER OIDC_CLIENT_ID OIDC_CLIENT_SECRET VC_ISSUER_DID VC_ISSUER_DOMAIN; do
|
|
if grep -q "^${key}=" "${SECRETS_FILE}" 2>/dev/null; then
|
|
log_success "${key} found in ${SECRETS_FILE}"
|
|
else
|
|
log_warning "${key} is not present in ${SECRETS_FILE}"
|
|
fi
|
|
done
|
|
|
|
log_info "Secrets configuration complete"
|
|
log_info "Keep ${SECRETS_FILE} out of version control and merge it into the runtime env on the target CT when needed."
|
|
|
|
# Save state
|
|
save_state "phase8" "complete"
|
|
|
|
log_success "=========================================="
|
|
log_success "Phase 8: Secrets Configuration - COMPLETE"
|
|
log_success "=========================================="
|