d138f00a20
Some checks failed
Sync infra to hosts / sync-beta (push) Has been skipped
Sync infra to hosts / sync-prod (push) Has been skipped
Sync infra to hosts / sync-dev (push) Failing after 6s
secrets-guard / encrypted (push) Successful in 6s
shell-lint / shellcheck (push) Successful in 13s
Validate observability stack / validate (push) Successful in 17s
PR build (required check) / changes (pull_request) Successful in 6s
secrets-guard / encrypted (pull_request) Successful in 5s
PR build (required check) / build-backend (pull_request) Has been skipped
shell-lint / shellcheck (pull_request) Successful in 6s
PR build (required check) / build-frontend (pull_request) Has been skipped
PR build (required check) / validate-observability (pull_request) Successful in 18s
PR build (required check) / gate (pull_request) Successful in 2s
71 lines
3.7 KiB
Bash
Executable file
71 lines
3.7 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Provision a NAMED ENVIRONMENT to render secrets from the SOPS vault at deploy
|
|
# time. Idempotent; run once per environment (not once per box) as a
|
|
# sudo-capable user — vps2 carries two (prod AND beta), so it needs this run
|
|
# TWICE, each pointing SECRETS_ENV_FILE at that environment's own marker.
|
|
#
|
|
# SECRETS_ENV=prod AGE_KEY_SRC=/path/to/age.key bash deploy/provision-secrets.sh
|
|
# SECRETS_ENV=beta AGE_KEY_SRC=/path/to/age.key \
|
|
# SECRETS_ENV_FILE=/etc/thermograph/beta-secrets-env bash deploy/provision-secrets.sh
|
|
#
|
|
# Installs `sops` + `age` (idempotent, and shared across every environment on the
|
|
# box — one age key decrypts every deploy/secrets/<env>.yaml, since they're all
|
|
# encrypted to the same recipient), then installs the age PRIVATE key at
|
|
# /etc/thermograph/age.key (0400) and writes SECRETS_ENV_FILE (default
|
|
# /etc/thermograph/secrets-env — right for a single-environment host, dev
|
|
# included). After this, deploy.sh renders that environment's own
|
|
# /etc/thermograph*.env from deploy/secrets/*.yaml. See deploy/secrets/README.md.
|
|
#
|
|
# SECRETS_ENV_FILE only matters for a by-hand run with THERMOGRAPH_ENV unset:
|
|
# env-topology.sh's thermograph_env_name() falls back to reading it to decide
|
|
# which environment a bare `deploy.sh` means, and a host running two
|
|
# environments (vps2) cannot answer that from one shared marker — a by-hand
|
|
# deploy of beta there must export THERMOGRAPH_SECRETS_ENV_FILE to match
|
|
# whatever path this script wrote. CI-driven deploys pass THERMOGRAPH_ENV
|
|
# explicitly and never consult this file at all.
|
|
set -euo pipefail
|
|
|
|
SECRETS_ENV="${SECRETS_ENV:?set SECRETS_ENV=prod|beta|dev}"
|
|
AGE_KEY_SRC="${AGE_KEY_SRC:?set AGE_KEY_SRC=/path/to/the/age/private/key}"
|
|
# Where to write the env marker. Default matches the original, single-environment
|
|
# behavior; a SECOND environment on the same box (vps2's beta, alongside prod's
|
|
# default marker) must pass a distinct path so provisioning one can never
|
|
# overwrite the other's marker.
|
|
SECRETS_ENV_FILE="${SECRETS_ENV_FILE:-/etc/thermograph/secrets-env}"
|
|
SOPS_VERSION="${SOPS_VERSION:-v3.13.2}"
|
|
AGE_VERSION="${AGE_VERSION:-v1.3.1}"
|
|
BIN="${BIN:-/usr/local/bin}"
|
|
ARCH="$(uname -m)"; case "$ARCH" in x86_64) ARCH=amd64;; aarch64|arm64) ARCH=arm64;; esac
|
|
|
|
install_sops() {
|
|
command -v sops >/dev/null 2>&1 && { echo "==> sops already installed"; return; }
|
|
echo "==> Installing sops ${SOPS_VERSION}"
|
|
sudo curl -fsSL "https://github.com/getsops/sops/releases/download/${SOPS_VERSION}/sops-${SOPS_VERSION}.linux.${ARCH}" -o "${BIN}/sops"
|
|
sudo chmod +x "${BIN}/sops"
|
|
}
|
|
|
|
install_age() {
|
|
command -v age >/dev/null 2>&1 && { echo "==> age already installed"; return; }
|
|
echo "==> Installing age ${AGE_VERSION}"
|
|
tmp="$(mktemp -d)"
|
|
curl -fsSL "https://github.com/FiloSottile/age/releases/download/${AGE_VERSION}/age-${AGE_VERSION}-linux-${ARCH}.tar.gz" | tar -xz -C "$tmp"
|
|
sudo install -m 0755 "$tmp/age/age" "$tmp/age/age-keygen" "$BIN/"
|
|
rm -rf "$tmp"
|
|
}
|
|
|
|
install_sops
|
|
install_age
|
|
|
|
echo "==> Installing age key -> /etc/thermograph/age.key (0400) and marker ${SECRETS_ENV_FILE} (${SECRETS_ENV})"
|
|
sudo mkdir -p /etc/thermograph "$(dirname "$SECRETS_ENV_FILE")"
|
|
sudo install -m 0400 "$AGE_KEY_SRC" /etc/thermograph/age.key
|
|
printf '%s\n' "$SECRETS_ENV" | sudo tee "$SECRETS_ENV_FILE" >/dev/null
|
|
sudo chmod 0644 "$SECRETS_ENV_FILE"
|
|
|
|
echo "==> Done. Verify: sops --version && ls -l /etc/thermograph/"
|
|
echo " Next: seed deploy/secrets/*.yaml, dry-run render, then deploy (see README)."
|
|
if [ "$SECRETS_ENV_FILE" != /etc/thermograph/secrets-env ]; then
|
|
echo " NOTE: non-default marker -- a by-hand deploy of ${SECRETS_ENV} on this box"
|
|
echo " must export THERMOGRAPH_SECRETS_ENV_FILE=${SECRETS_ENV_FILE} (CI-driven"
|
|
echo " deploys pass THERMOGRAPH_ENV explicitly and never consult this file)."
|
|
fi
|