mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 19:54:32 +00:00
bcc8f23a0d
- Secret Management: Integrated AESGCM for temporary secret handling in install.py and enhanced OpenBao (Vault) support with namespace injection and additional secret paths (Grafana, Kerberos, TDE).
- Infrastructure & K8s:
- Added Barman Object Store backup configuration (S3) to prole-db.yaml.
- Updated Prometheus deployment with PVC and persistent configuration.
- Updated k3s cluster/registry creation scripts.
- Added etc/build-a-bao.sh for OpenBao setup.
- MSSQL Integration: Updated docker scripts and k8s deployments for Prole MSSQL database.
- Documentation: Added docs/PROLE-CFG-SECRETS.md explaining the new secret handling.
- General: Refined initialization scripts (init_authority.sh, init_openbao.sh, etc.) and updated the ncurses installer.
245 lines
8.4 KiB
Bash
Executable File
245 lines
8.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
# build-a-bao.sh
|
|
# Purpose:
|
|
# - Decrypt temporary secrets stored in prole.cfg
|
|
# - Store them in OpenBao for the current namespace
|
|
# - Replace prole.cfg secrets with OpenBao placeholders
|
|
|
|
SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
|
|
|
|
# Load environment and config via prole_cfg.sh
|
|
# shellcheck disable=SC1090
|
|
source "$SCRIPT_DIR/prole_cfg.sh"
|
|
|
|
cfg_path=""
|
|
if [[ -n "${PROLE_CONF:-}" && -f "$PROLE_CONF/prole.cfg" ]]; then
|
|
cfg_path="$PROLE_CONF/prole.cfg"
|
|
elif [[ -n "${PROLE_HOME:-}" && -f "$PROLE_HOME/conf/prole.cfg" ]]; then
|
|
cfg_path="$PROLE_HOME/conf/prole.cfg"
|
|
elif [[ -f "$SCRIPT_DIR/../conf/prole.cfg" ]]; then
|
|
cfg_path="$SCRIPT_DIR/../conf/prole.cfg"
|
|
fi
|
|
|
|
if [[ -z "$cfg_path" || ! -f "$cfg_path" ]]; then
|
|
echo "ERROR: prole.cfg not found. Set PROLE_CONF or PROLE_HOME." >&2
|
|
exit 1
|
|
fi
|
|
|
|
tmp_env="$(mktemp)"
|
|
python3 - "$cfg_path" >"$tmp_env" <<'PY'
|
|
import base64
|
|
import configparser
|
|
import getpass
|
|
import os
|
|
import platform
|
|
import shlex
|
|
import subprocess
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
PROLE_SECRET_PREFIX = "${PROLE_SECRET:"
|
|
PROLE_SECRET_SUFFIX = "}"
|
|
OPENBAO_PREFIX = "${OPENBAO:"
|
|
OPENBAO_SUFFIX = "}"
|
|
PROLE_SECRET_VERSION = "v1"
|
|
PROLE_SECRET_SERVICE = "prole-installer"
|
|
PROLE_SECRET_KEY_FILE = Path.home() / ".prole" / "secrets" / "installer.key"
|
|
|
|
def is_prole_secret(value: str | None) -> bool:
|
|
return bool(value) and value.startswith(PROLE_SECRET_PREFIX) and value.endswith(PROLE_SECRET_SUFFIX)
|
|
|
|
def is_openbao_ref(value: str | None) -> bool:
|
|
return bool(value) and value.startswith(OPENBAO_PREFIX) and value.endswith(OPENBAO_SUFFIX)
|
|
|
|
def get_keychain_key(service: str, account: str) -> bytes:
|
|
try:
|
|
res = subprocess.run(
|
|
["security", "find-generic-password", "-a", account, "-s", service, "-w"],
|
|
capture_output=True,
|
|
text=True,
|
|
)
|
|
if res.returncode == 0 and res.stdout.strip():
|
|
return base64.urlsafe_b64decode(res.stdout.strip().encode("utf-8"))
|
|
except Exception:
|
|
pass
|
|
key_b64 = base64.urlsafe_b64encode(os.urandom(32)).decode("utf-8")
|
|
try:
|
|
subprocess.run(
|
|
["security", "add-generic-password", "-a", account, "-s", service, "-w", key_b64, "-U"],
|
|
capture_output=True,
|
|
text=True,
|
|
)
|
|
except Exception:
|
|
pass
|
|
return base64.urlsafe_b64decode(key_b64.encode("utf-8"))
|
|
|
|
def get_file_key(path: Path) -> bytes:
|
|
path.parent.mkdir(parents=True, exist_ok=True)
|
|
if path.exists():
|
|
raw = path.read_text().strip()
|
|
try:
|
|
return base64.urlsafe_b64decode(raw.encode("utf-8"))
|
|
except Exception:
|
|
pass
|
|
key_b64 = base64.urlsafe_b64encode(os.urandom(32)).decode("utf-8")
|
|
path.write_text(key_b64)
|
|
try:
|
|
os.chmod(path, 0o600)
|
|
except Exception:
|
|
pass
|
|
return base64.urlsafe_b64decode(key_b64.encode("utf-8"))
|
|
|
|
def get_secret_key() -> bytes:
|
|
system = platform.system()
|
|
account = getpass.getuser() or "prole"
|
|
if system == "Darwin":
|
|
return get_keychain_key(PROLE_SECRET_SERVICE, account)
|
|
return get_file_key(PROLE_SECRET_KEY_FILE)
|
|
|
|
def decrypt_prole_secret(value: str) -> str:
|
|
if not is_prole_secret(value):
|
|
return value
|
|
inner = value[len(PROLE_SECRET_PREFIX):-len(PROLE_SECRET_SUFFIX)]
|
|
parts = inner.split(":")
|
|
if len(parts) != 3 or parts[0] != PROLE_SECRET_VERSION:
|
|
return ""
|
|
try:
|
|
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
|
|
nonce = base64.urlsafe_b64decode(parts[1].encode("utf-8"))
|
|
ciphertext = base64.urlsafe_b64decode(parts[2].encode("utf-8"))
|
|
key = get_secret_key()
|
|
aesgcm = AESGCM(key)
|
|
return aesgcm.decrypt(nonce, ciphertext, None).decode("utf-8")
|
|
except Exception:
|
|
return ""
|
|
|
|
cfg_path = Path(sys.argv[1]).expanduser()
|
|
cfg = configparser.ConfigParser(interpolation=None)
|
|
cfg.optionxform = str
|
|
cfg.read(cfg_path)
|
|
|
|
def get_val(section: str, key: str) -> str:
|
|
if cfg.has_option(section, key):
|
|
return cfg.get(section, key, fallback="").strip()
|
|
return ""
|
|
|
|
namespace = get_val("Global", "NAMESPACE") or get_val("Inputs", "env_setup.NAMESPACE") or get_val("Database Creation", "NAMESPACE") or "default"
|
|
db_user = get_val("Inputs", "init_password.db_username") or get_val("Global", "PROLE_DB_USER")
|
|
db_pass = get_val("Inputs", "init_password.db_password") or get_val("Global", "DB_PASSWORD")
|
|
krb_realm = get_val("Inputs", "kerberos_config.realm") or get_val("Kerberos Authentication", "REALM")
|
|
krb_kdc = get_val("Inputs", "kerberos_config.kdc") or get_val("Kerberos Authentication", "KDC")
|
|
krb_user = get_val("Inputs", "kerberos_config.user") or get_val("Kerberos Authentication", "USER")
|
|
krb_pass = get_val("Inputs", "kerberos_config.password") or get_val("Kerberos Authentication", "PASSWORD")
|
|
grafana_pass = get_val("Monitoring", "GRAFANA_ADMIN_PASSWORD")
|
|
at_rest = get_val("Inputs", "init_cluster.at_rest_encryption_enabled") or get_val("Optional Features", "AT_REST_ENCRYPTION_ENABLED")
|
|
|
|
if db_pass and not is_openbao_ref(db_pass):
|
|
db_pass = decrypt_prole_secret(db_pass)
|
|
else:
|
|
db_pass = ""
|
|
if krb_pass and not is_openbao_ref(krb_pass):
|
|
krb_pass = decrypt_prole_secret(krb_pass)
|
|
else:
|
|
krb_pass = ""
|
|
if grafana_pass and not is_openbao_ref(grafana_pass):
|
|
grafana_pass = decrypt_prole_secret(grafana_pass)
|
|
else:
|
|
grafana_pass = ""
|
|
|
|
def emit(key: str, value: str):
|
|
if value is None:
|
|
value = ""
|
|
print(f"export {key}={shlex.quote(str(value))}")
|
|
|
|
emit("NAMESPACE", namespace)
|
|
emit("PROLE_DB_USER", db_user)
|
|
emit("PROLE_DB_PASSWORD", db_pass)
|
|
emit("KRB5_REALM", krb_realm)
|
|
emit("KRB5_KDC", krb_kdc)
|
|
emit("KRB5_ADMIN", krb_kdc)
|
|
emit("KRB5_USER", krb_user)
|
|
emit("KRB5_PASSWORD", krb_pass)
|
|
emit("GRAFANA_ADMIN_PASSWORD", grafana_pass)
|
|
emit("AT_REST_ENCRYPTION_ENABLED", at_rest)
|
|
PY
|
|
|
|
# shellcheck disable=SC1090
|
|
source "$tmp_env"
|
|
rm -f "$tmp_env"
|
|
|
|
export PROLE_HOME="${PROLE_HOME:-$(cd "$SCRIPT_DIR/.." && pwd)}"
|
|
export PROLE_SERVICE="${PROLE_SERVICE:-$PROLE_HOME}"
|
|
export NAMESPACE="${NAMESPACE:-default}"
|
|
|
|
db_pass="${PROLE_DB_PASSWORD:-}"
|
|
if [[ -z "$db_pass" ]]; then
|
|
echo "[WARN] No database password found in prole.cfg; skipping db secret write."
|
|
fi
|
|
|
|
if [[ -n "$db_pass" ]]; then
|
|
printf '%s\n' "$db_pass" | "$SCRIPT_DIR/init_openbao.sh" initialize
|
|
else
|
|
"$SCRIPT_DIR/init_openbao.sh" initialize </dev/null
|
|
fi
|
|
|
|
python3 - "$cfg_path" <<'PY'
|
|
import configparser
|
|
import re
|
|
import sys
|
|
|
|
cfg_path = sys.argv[1]
|
|
cfg = configparser.ConfigParser(interpolation=None)
|
|
cfg.optionxform = str
|
|
cfg.read(cfg_path)
|
|
|
|
def get_val(section: str, key: str) -> str:
|
|
if cfg.has_option(section, key):
|
|
return cfg.get(section, key, fallback="").strip()
|
|
return ""
|
|
|
|
namespace = get_val("Global", "NAMESPACE") or get_val("Inputs", "env_setup.NAMESPACE") or get_val("Database Creation", "NAMESPACE") or "default"
|
|
def openbao_placeholder(ns: str, leaf: str, key: str) -> str:
|
|
return f"${{OPENBAO:kv/prole/{ns}/{leaf}#{key}}}"
|
|
|
|
secret_map = {
|
|
"init_password.db_password": openbao_placeholder(namespace, "db", "password"),
|
|
"init_password.db_password_confirm": openbao_placeholder(namespace, "db", "password"),
|
|
"kerberos_config.password": openbao_placeholder(namespace, "kerberos", "password"),
|
|
"DB_PASSWORD": openbao_placeholder(namespace, "db", "password"),
|
|
"PASSWORD": openbao_placeholder(namespace, "kerberos", "password"),
|
|
"GRAFANA_ADMIN_PASSWORD": openbao_placeholder(namespace, "monitoring", "grafana_admin_password"),
|
|
}
|
|
|
|
pattern = re.compile(r"^(?P<lead>\s*)(?P<key>[^=]+?)(?P<pre>\s*)=(?P<post>\s*).*$")
|
|
out_lines = []
|
|
|
|
with open(cfg_path, "r", encoding="utf-8") as f:
|
|
for line in f.read().splitlines():
|
|
stripped = line.strip()
|
|
if not stripped or stripped.startswith((';', '#')) or '=' not in line:
|
|
out_lines.append(line)
|
|
continue
|
|
m = pattern.match(line)
|
|
if not m:
|
|
out_lines.append(line)
|
|
continue
|
|
key = m.group("key").strip()
|
|
lead = m.group("lead")
|
|
pre = m.group("pre")
|
|
post = m.group("post")
|
|
if key in secret_map:
|
|
out_lines.append(f"{lead}{key}{pre}={post}{secret_map[key]}")
|
|
continue
|
|
if re.search(r"(?i)(?:^|[_.])(password|token|secret)$", key):
|
|
out_lines.append(f"{lead}{key}{pre}={post}${{OPENBAO:REDACTED}}")
|
|
continue
|
|
out_lines.append(line)
|
|
|
|
with open(cfg_path, "w", encoding="utf-8") as f:
|
|
f.write("\n".join(out_lines) + "\n")
|
|
print(f"[OK] Updated secrets in {cfg_path}")
|
|
PY
|