Nasim SadatandClaude Opus 5.5
d3800ac9dd
Traefik as the server-wide edge (TLS via Let's Encrypt, dashboard on traefik.petrolyst.com behind oauth2-proxy and Keycloak). The fuel-monitoring stack: Superset on atoma.petrolyst.com with Keycloak login and Petrolyst branding, Trino reading the TimescaleDB fuel-db as catalog "fuel". Customization lives in petrolyst-insights/, deployment in the other folders. Deploys run server-side (deploy/deploy.sh) from a Gitea workflow or manually; releases are immutable, Superset metadata is backed up before migrations, and deploy/rollback.sh restores it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
87 lines
3.1 KiB
Bash
Executable File
87 lines
3.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Server secrets and env files, run as root after bootstrap.sh.
|
|
# secrets-init.sh generate every missing secret; never overwrites one
|
|
# secrets-init.sh keycloak-secret store the client secret of Keycloak client
|
|
# "petrolyst" (Clients > petrolyst > Credentials),
|
|
# read from the terminal or stdin
|
|
#
|
|
# Layout: /opt/petrolyst/secrets/{shared,traefik,fuel-monitoring}/ are root:deploy
|
|
# 0750, so only root and the deploy user can reach them; the files are 0444
|
|
# because each container reads them under its own uid.
|
|
set -euo pipefail
|
|
|
|
die() { echo "ERROR: $*" >&2; exit 1; }
|
|
[ "$(id -u)" = 0 ] || die "run as root"
|
|
getent group deploy >/dev/null || die "group deploy is missing: run host/bootstrap.sh first"
|
|
|
|
ROOT=/opt/petrolyst
|
|
SECRETS=$ROOT/secrets
|
|
umask 077
|
|
install -d -o root -g deploy -m 0750 "$SECRETS" "$SECRETS/shared" "$SECRETS/traefik" "$SECRETS/fuel-monitoring" "$ROOT/env"
|
|
|
|
# write_secret <path> <value>: no trailing newline (oauth2-proxy reads the file
|
|
# byte for byte), replaced atomically.
|
|
write_secret() {
|
|
printf '%s' "$2" >"$1.tmp"
|
|
chown root:deploy "$1.tmp"
|
|
chmod 0444 "$1.tmp"
|
|
mv "$1.tmp" "$1"
|
|
}
|
|
|
|
generate() {
|
|
if [ -s "$1" ]; then
|
|
echo "kept $1"
|
|
else
|
|
write_secret "$1" "$(openssl rand -hex "$2")"
|
|
echo "generated $1"
|
|
fi
|
|
}
|
|
|
|
case ${1:-all} in
|
|
keycloak-secret)
|
|
if [ -t 0 ]; then
|
|
printf 'Client secret of Keycloak client "petrolyst": ' >&2
|
|
IFS= read -rs value
|
|
echo >&2
|
|
else
|
|
IFS= read -r value
|
|
fi
|
|
value=$(printf '%s' "$value" | tr -d '[:space:]')
|
|
[ -n "$value" ] || die "empty secret"
|
|
write_secret "$SECRETS/shared/keycloak_petrolyst_client_secret" "$value"
|
|
echo "stored $SECRETS/shared/keycloak_petrolyst_client_secret"
|
|
exit 0
|
|
;;
|
|
all) ;;
|
|
*) die "usage: secrets-init.sh [keycloak-secret]" ;;
|
|
esac
|
|
|
|
# Hex only, so no value ever needs quoting in a URL or a properties file.
|
|
generate "$SECRETS/fuel-monitoring/superset_secret_key" 32
|
|
generate "$SECRETS/fuel-monitoring/superset_db_password" 32
|
|
generate "$SECRETS/fuel-monitoring/fuel_db_password" 32
|
|
generate "$SECRETS/fuel-monitoring/fuel_db_trino_password" 32
|
|
# 32 hex characters = a 32-byte cookie key, as oauth2-proxy requires.
|
|
generate "$SECRETS/traefik/oauth2_proxy_cookie_secret" 16
|
|
|
|
# Trino reads the catalog password from its environment (${ENV:...}); keep the
|
|
# env file in step with the secret file that fuel-db's init script uses.
|
|
env_file=$ROOT/env/fuel-monitoring.env
|
|
line="FUEL_DB_TRINO_PASSWORD=$(cat "$SECRETS/fuel-monitoring/fuel_db_trino_password")"
|
|
if ! grep -qxF "$line" "$env_file" 2>/dev/null; then
|
|
printf '%s\n' "$line" >"$env_file.tmp"
|
|
chown root:deploy "$env_file.tmp"
|
|
chmod 0440 "$env_file.tmp"
|
|
mv "$env_file.tmp" "$env_file"
|
|
echo "wrote $env_file"
|
|
fi
|
|
|
|
if [ ! -s "$SECRETS/shared/keycloak_petrolyst_client_secret" ]; then
|
|
echo
|
|
echo "Still missing: the Keycloak client secret. Copy it from Keycloak"
|
|
echo "(realm thedigitalbridge > Clients > petrolyst > Credentials), then run:"
|
|
echo " $0 keycloak-secret"
|
|
exit 1
|
|
fi
|
|
echo "All secrets present."
|