mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 12:03:59 +00:00
d4deac643d
openssl rand -base64 32 produces a 44-char string; oauth2-proxy treats it as 44 raw bytes and rejects it. -base64 24 encodes 24 bytes → 32 base64 chars with no padding, which satisfies the 32-byte AES requirement.
101 lines
4.3 KiB
Bash
Executable File
101 lines
4.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# fetch_prole_secrets.sh
|
|
#
|
|
# Pulls prole.org Google OAuth credentials from 1Password into etc/secrets/
|
|
# so the init scripts can consume them via the standard resolve_secret() path.
|
|
#
|
|
# Items read (Personal vault, category API_CREDENTIAL):
|
|
# svc-prole-org → grafana-google-oidc-client-{id,secret}-prole
|
|
# db-prole-org → oauth2-proxy-client-{id,secret}-prole
|
|
#
|
|
# Cookie secret:
|
|
# If already stored as field 'cookie_secret' in db-prole-org, uses that.
|
|
# Otherwise generates a 32-char base64 secret (openssl rand -base64 24 → 32 chars = 32 bytes, valid for AES), writes it to
|
|
# etc/secrets/oauth2-proxy-cookie-secret-prole, and saves it back to the
|
|
# db-prole-org item so it's durable in 1Password.
|
|
#
|
|
# Usage:
|
|
# ./etc/fetch_prole_secrets.sh
|
|
# # Then run the init scripts:
|
|
# ./etc/init_grafana_oauth_prole.sh
|
|
# ./etc/init_oauth2_proxy_prole.sh
|
|
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
|
SECRETS_DIR="$REPO_ROOT/etc/secrets"
|
|
|
|
log() { printf "[%s] %s\n" "$(date +%H:%M:%S)" "$*"; }
|
|
die() { log "ERROR: $*" >&2; exit 1; }
|
|
|
|
command -v op >/dev/null 2>&1 || die "'op' (1Password CLI) not found. Install: brew install 1password-cli"
|
|
|
|
if ! op account list >/dev/null 2>&1 || ! op vault list >/dev/null 2>&1; then
|
|
log "Not signed in to 1Password — signing in..."
|
|
eval "$(op signin)"
|
|
fi
|
|
|
|
mkdir -p "$SECRETS_DIR"
|
|
chmod 700 "$SECRETS_DIR"
|
|
|
|
write_secret() {
|
|
local file="$SECRETS_DIR/$1" value="$2"
|
|
printf '%s' "$value" > "$file"
|
|
chmod 600 "$file"
|
|
log " wrote $file"
|
|
}
|
|
|
|
# ── svc-prole-org → Grafana OAuth ────────────────────────────────────────────
|
|
|
|
log "Fetching svc-prole-org (Grafana / svc.prole.org) ..."
|
|
SVC_CLIENT_ID="$(op item get "svc-prole-org" --fields username 2>/dev/null)" \
|
|
|| die "Could not read svc-prole-org from 1Password"
|
|
SVC_CLIENT_SECRET="$(op item get "svc-prole-org" --fields credential --reveal 2>/dev/null)" \
|
|
|| die "Could not read svc-prole-org credential from 1Password"
|
|
|
|
write_secret "grafana-google-oidc-client-id-prole" "$SVC_CLIENT_ID"
|
|
write_secret "grafana-google-oidc-client-secret-prole" "$SVC_CLIENT_SECRET"
|
|
|
|
# ── db-prole-org → oauth2-proxy (Studio / db.prole.org) ──────────────────────
|
|
|
|
log "Fetching db-prole-org (oauth2-proxy / db.prole.org) ..."
|
|
DB_CLIENT_ID="$(op item get "db-prole-org" --fields username 2>/dev/null)" \
|
|
|| die "Could not read db-prole-org from 1Password"
|
|
DB_CLIENT_SECRET="$(op item get "db-prole-org" --fields credential --reveal 2>/dev/null)" \
|
|
|| die "Could not read db-prole-org credential from 1Password"
|
|
|
|
write_secret "oauth2-proxy-client-id-prole" "$DB_CLIENT_ID"
|
|
write_secret "oauth2-proxy-client-secret-prole" "$DB_CLIENT_SECRET"
|
|
|
|
# ── Cookie secret ─────────────────────────────────────────────────────────────
|
|
|
|
log "Resolving oauth2-proxy cookie secret ..."
|
|
COOKIE_SECRET=""
|
|
|
|
# Check if already stored in 1Password (may not exist on first run)
|
|
COOKIE_SECRET="$(op item get "db-prole-org" --fields label=cookie_secret --reveal 2>/dev/null || true)"
|
|
|
|
if [[ -z "$COOKIE_SECRET" ]]; then
|
|
log " No cookie_secret field in db-prole-org — generating new 32-byte secret ..."
|
|
COOKIE_SECRET="$(openssl rand -base64 24)"
|
|
|
|
log " Saving cookie_secret back to db-prole-org in 1Password ..."
|
|
op item edit "db-prole-org" \
|
|
"cookie_secret[password]=${COOKIE_SECRET}" >/dev/null \
|
|
|| die "Failed to save cookie_secret to 1Password"
|
|
log " Saved."
|
|
fi
|
|
|
|
write_secret "oauth2-proxy-cookie-secret-prole" "$COOKIE_SECRET"
|
|
|
|
# ── Summary ───────────────────────────────────────────────────────────────────
|
|
|
|
log ""
|
|
log "==> All prole.org secrets written to etc/secrets/:"
|
|
ls -1 "$SECRETS_DIR/"*-prole 2>/dev/null | while read -r f; do log " $f"; done
|
|
log ""
|
|
log "Next steps:"
|
|
log " ./etc/init_grafana_oauth_prole.sh # applies grafana-google-oidc Secret"
|
|
log " ./etc/init_oauth2_proxy_prole.sh # deploys oauth2-proxy for db.prole.org"
|