mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 11:03:59 +00:00
3f96f66a78
Rewrites (updated for knoe namespace, GKE support, and current service configs): init_gitlab.sh, init_kong.sh, init_cnpg_backup.sh, init_monitoring.sh, init_garage_store.sh, init_gitea.sh, init_kdc.sh, init_openbao.sh, init_argocd.sh, init_certmgr.sh, init_common_services.sh, init_db_manager.sh, init_forgejo.sh, init_k3s_registry.sh, init_kerberos.sh, init_nginx_ingress.sh, init_port_forwards.sh, init_registry.sh, init_service_layer.sh Deleted: init_cloudnative_pg.sh (superseded by init_cnpg_gke.sh) New scripts: init_cnpg_gke.sh — CNPG setup for GKE with Workload Identity init_knoe_auth.sh — knoe-auth OIDC service init init_knoe_users.sh — user provisioning init_redis.sh — Redis init init_oauth2_proxy.sh / init_oauth2_proxy_prole.sh — OAuth2 proxy setup init_grafana_oauth.sh / init_grafana_oauth_prole.sh — Grafana OAuth wiring init_1password.sh — 1Password Connect init init_min.sh — minimal bootstrap Co-authored-by: Junie <junie@jetbrains.com>
80 lines
3.1 KiB
Bash
Executable File
80 lines
3.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# init_1password.sh
|
|
# Preflight: sign in to 1Password, create the 'knoey' vault if absent,
|
|
# and ensure the 'administrator' item (DB master password) exists.
|
|
#
|
|
# Called by install.sh before the Python installer. Skipped in --min mode.
|
|
|
|
set -euo pipefail
|
|
|
|
# ── helpers ────────────────────────────────────────────────────────────────
|
|
|
|
_info() { echo "==> [1Password] $*"; }
|
|
_warn() { echo " [WARN] $*" >&2; }
|
|
_fatal() { echo " [ERROR] $*" >&2; exit 1; }
|
|
|
|
VAULT="knoey"
|
|
ADMIN_ITEM="administrator"
|
|
|
|
# ── skip in --min mode ─────────────────────────────────────────────────────
|
|
|
|
for arg in "$@"; do
|
|
if [[ "$arg" == "--min" ]]; then
|
|
_warn "Skipping 1Password preflight in --min mode."
|
|
exit 0
|
|
fi
|
|
done
|
|
|
|
# ── require op CLI ─────────────────────────────────────────────────────────
|
|
|
|
if ! command -v op >/dev/null 2>&1; then
|
|
_fatal "1Password CLI (op) not found.
|
|
Install: brew install 1password-cli
|
|
Docs: https://developer.1password.com/docs/cli"
|
|
fi
|
|
|
|
_info "op CLI found: $(op --version)"
|
|
|
|
# ── sign in ────────────────────────────────────────────────────────────────
|
|
|
|
if ! op whoami >/dev/null 2>&1; then
|
|
# If running non-interactively (no TTY), skip rather than hang.
|
|
if [[ ! -t 0 ]]; then
|
|
_warn "No active 1Password session and no TTY — skipping 1Password preflight."
|
|
exit 0
|
|
fi
|
|
_info "No active 1Password session. Signing in..."
|
|
op signin
|
|
fi
|
|
|
|
_info "Signed in as: $(op whoami --format json 2>/dev/null | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('email','unknown'))" 2>/dev/null || op whoami)"
|
|
|
|
# ── create knoey vault if absent ───────────────────────────────────────────
|
|
|
|
if op vault get "$VAULT" >/dev/null 2>&1; then
|
|
_info "Vault '$VAULT' already exists."
|
|
else
|
|
_info "Creating vault '$VAULT'..."
|
|
op vault create "$VAULT"
|
|
_info "Vault '$VAULT' created."
|
|
fi
|
|
|
|
# ── ensure administrator item exists ───────────────────────────────────────
|
|
|
|
if op item get "$ADMIN_ITEM" --vault "$VAULT" >/dev/null 2>&1; then
|
|
_info "Item '$ADMIN_ITEM' already exists in vault '$VAULT'."
|
|
else
|
|
_info "Creating item '$ADMIN_ITEM' in vault '$VAULT' with a generated password..."
|
|
op item create \
|
|
--category login \
|
|
--title "$ADMIN_ITEM" \
|
|
--vault "$VAULT" \
|
|
--generate-password="32,letters,digits"
|
|
_info "Item '$ADMIN_ITEM' created."
|
|
fi
|
|
|
|
# ── export for child processes ─────────────────────────────────────────────
|
|
|
|
export OP_VAULT="$VAULT"
|
|
_info "OP_VAULT=$OP_VAULT"
|