46 lines
2 KiB
Bash
46 lines
2 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
# Provision a host to render secrets from the SOPS vault at deploy time. Idempotent;
|
||
|
|
# run once per box (prod/beta) as a sudo-capable user.
|
||
|
|
#
|
||
|
|
# SECRETS_ENV=prod AGE_KEY_SRC=/path/to/age.key bash deploy/provision-secrets.sh
|
||
|
|
#
|
||
|
|
# Installs `sops` + `age`, then installs the age PRIVATE key at /etc/thermograph/age.key
|
||
|
|
# (0400) and writes /etc/thermograph/secrets-env. After this, deploy.sh renders
|
||
|
|
# /etc/thermograph.env from deploy/secrets/*.yaml. See deploy/secrets/README.md.
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
SECRETS_ENV="${SECRETS_ENV:?set SECRETS_ENV=prod|beta}"
|
||
|
|
AGE_KEY_SRC="${AGE_KEY_SRC:?set AGE_KEY_SRC=/path/to/the/age/private/key}"
|
||
|
|
SOPS_VERSION="${SOPS_VERSION:-v3.13.2}"
|
||
|
|
AGE_VERSION="${AGE_VERSION:-v1.3.1}"
|
||
|
|
BIN="${BIN:-/usr/local/bin}"
|
||
|
|
ARCH="$(uname -m)"; case "$ARCH" in x86_64) ARCH=amd64;; aarch64|arm64) ARCH=arm64;; esac
|
||
|
|
|
||
|
|
install_sops() {
|
||
|
|
command -v sops >/dev/null 2>&1 && { echo "==> sops already installed"; return; }
|
||
|
|
echo "==> Installing sops ${SOPS_VERSION}"
|
||
|
|
sudo curl -fsSL "https://github.com/getsops/sops/releases/download/${SOPS_VERSION}/sops-${SOPS_VERSION}.linux.${ARCH}" -o "${BIN}/sops"
|
||
|
|
sudo chmod +x "${BIN}/sops"
|
||
|
|
}
|
||
|
|
|
||
|
|
install_age() {
|
||
|
|
command -v age >/dev/null 2>&1 && { echo "==> age already installed"; return; }
|
||
|
|
echo "==> Installing age ${AGE_VERSION}"
|
||
|
|
tmp="$(mktemp -d)"
|
||
|
|
curl -fsSL "https://github.com/FiloSottile/age/releases/download/${AGE_VERSION}/age-${AGE_VERSION}-linux-${ARCH}.tar.gz" | tar -xz -C "$tmp"
|
||
|
|
sudo install -m 0755 "$tmp/age/age" "$tmp/age/age-keygen" "$BIN/"
|
||
|
|
rm -rf "$tmp"
|
||
|
|
}
|
||
|
|
|
||
|
|
install_sops
|
||
|
|
install_age
|
||
|
|
|
||
|
|
echo "==> Installing age key -> /etc/thermograph/age.key (0400) and marker (${SECRETS_ENV})"
|
||
|
|
sudo mkdir -p /etc/thermograph
|
||
|
|
sudo install -m 0400 "$AGE_KEY_SRC" /etc/thermograph/age.key
|
||
|
|
printf '%s\n' "$SECRETS_ENV" | sudo tee /etc/thermograph/secrets-env >/dev/null
|
||
|
|
sudo chmod 0644 /etc/thermograph/secrets-env
|
||
|
|
|
||
|
|
echo "==> Done. Verify: sops --version && ls -l /etc/thermograph/"
|
||
|
|
echo " Next: seed deploy/secrets/*.yaml, dry-run render, then deploy (see README)."
|