37 lines
1.2 KiB
Bash
37 lines
1.2 KiB
Bash
 
|
#!/usr/bin/env bash
|
||
|
|
# Make throwaway secrets for a CI or local end-to-end run of compose.ci.yaml.
|
||
|
|
# Every value is random and new on each run. Nothing here is ever committed:
|
||
|
|
# deploy/ci/ci-secrets/ and deploy/ci/ci-backups/ are gitignored and dockerignored.
|
||
|
|
# Also makes an empty CA bundle placeholder (phase 1 swaps in the Samba DC's CA)
|
||
|
|
# and an empty backup folder for the worker's read-only mount.
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||
|
|
out="$here/ci-secrets"
|
||
|
|
backups="$here/ci-backups"
|
||
|
|
|
||
|
|
umask 077
|
||
|
|
mkdir -p "$out" "$backups"
|
||
|
|
|
||
|
|
rand() {
|
||
|
|
# 32 random bytes as hex. No newline, so the file holds exactly the value.
|
||
|
|
od -An -N32 -tx1 /dev/urandom | tr -d ' \n'
|
||
|
|
}
|
||
|
|
|
||
|
|
for name in \
|
||
|
|
postgres_superuser_password postgres_migrate_password postgres_app_password \
|
||
|
|
visualkit_password mfileskit_password ldap_bind_password \
|
||
|
|
session_key seal_key
|
||
|
|
do
|
||
|
|
rand > "$out/$name"
|
||
|
|
done
|
||
|
|
|
||
|
|
: > "$out/ca.pem"
|
||
|
|
|
||
|
|
# CI only: the containers run as uid 10001 and uid 999 (postgres), not as the runner's
|
||
|
|
# user, so the throwaway files are world-readable. Production files are root:10001 0440.
|
||
|
|
chmod 0755 "$out" "$backups"
|
||
|
|
chmod 0444 "$out"/*
|
||
|
|
|
||
|
|
echo "make-secrets: wrote $(ls "$out" | wc -l) files to $out"
|