mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 19:44:33 +00:00
bcc8f23a0d
- Secret Management: Integrated AESGCM for temporary secret handling in install.py and enhanced OpenBao (Vault) support with namespace injection and additional secret paths (Grafana, Kerberos, TDE).
- Infrastructure & K8s:
- Added Barman Object Store backup configuration (S3) to prole-db.yaml.
- Updated Prometheus deployment with PVC and persistent configuration.
- Updated k3s cluster/registry creation scripts.
- Added etc/build-a-bao.sh for OpenBao setup.
- MSSQL Integration: Updated docker scripts and k8s deployments for Prole MSSQL database.
- Documentation: Added docs/PROLE-CFG-SECRETS.md explaining the new secret handling.
- General: Refined initialization scripts (init_authority.sh, init_openbao.sh, etc.) and updated the ncurses installer.
72 lines
2.1 KiB
Bash
Executable File
72 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -o pipefail
|
|
|
|
SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
|
|
# shellcheck disable=SC1090
|
|
source "$SCRIPT_DIR/../etc/prole_cfg.sh"
|
|
|
|
set -euo pipefail
|
|
|
|
PROLE_HOME="${PROLE_HOME:-$(cd "$SCRIPT_DIR/.." && pwd)}"
|
|
export PROLE_HOME
|
|
PROLE_SERVICE="${PROLE_SERVICE:-$PROLE_HOME/etc}"
|
|
export PROLE_SERVICE
|
|
|
|
openbao_url() {
|
|
if [[ -n "${PROLE_OPENBAO_URL:-}" ]]; then
|
|
echo "$PROLE_OPENBAO_URL"
|
|
return 0
|
|
fi
|
|
echo "http://127.0.0.1:18200"
|
|
}
|
|
|
|
openbao_token() {
|
|
if [[ -f "$PROLE_SERVICE/secrets/openbao-root-token" ]]; then
|
|
cat "$PROLE_SERVICE/secrets/openbao-root-token"
|
|
else
|
|
echo "${OPENBAO_ROOT_TOKEN:-}"
|
|
fi
|
|
}
|
|
|
|
fetch_openbao_secret() {
|
|
local path="$1"
|
|
local key="$2"
|
|
local token url
|
|
token=$(openbao_token)
|
|
url=$(openbao_url)
|
|
if [[ -z "$token" ]]; then
|
|
echo ""
|
|
return 0
|
|
fi
|
|
curl -sS -H "X-Vault-Token: $token" "$url/v1/kv/data/$path" | jq -r ".data.data.\"$key\"" || echo ""
|
|
}
|
|
|
|
PROLE_PASSWD="${PROLE_PASSWD:-}"
|
|
if [[ -z "$PROLE_PASSWD" || "$PROLE_PASSWD" == '${OPENBAO:'* || "$PROLE_PASSWD" == '${PROLE_SECRET:'* ]]; then
|
|
command -v curl >/dev/null 2>&1 || { echo "ERROR: curl is required to read OpenBao secrets." >&2; exit 1; }
|
|
command -v jq >/dev/null 2>&1 || { echo "ERROR: jq is required to read OpenBao secrets." >&2; exit 1; }
|
|
path="prole/${NAMESPACE:-default}/db"
|
|
fetched=$(fetch_openbao_secret "$path" "password")
|
|
if [[ -n "$fetched" && "$fetched" != "null" ]]; then
|
|
PROLE_PASSWD="$fetched"
|
|
fi
|
|
fi
|
|
if [[ -z "$PROLE_PASSWD" ]]; then
|
|
echo "ERROR: PROLE_PASSWD is required. Store it in OpenBao (kv/prole/<namespace>/db#password) or export it." >&2
|
|
exit 1
|
|
fi
|
|
|
|
HOST_IP="${HOST_IP:-}"
|
|
if [[ -z "$HOST_IP" ]]; then
|
|
HOST_IP=$(ifconfig en0 2>/dev/null | grep 'inet ' | awk '{print $2}' | head -n1 || true)
|
|
fi
|
|
if [[ -z "$HOST_IP" ]]; then
|
|
echo "ERROR: Unable to detect HOST_IP. Set HOST_IP to the host interface address." >&2
|
|
exit 1
|
|
fi
|
|
k3d cluster create prole-data-cluster \
|
|
--agents 2 \
|
|
--registry-use k3d-prole-data-registry:5000 \
|
|
--registry-config ${PROLE_HOME}/k3s/registries.yaml \
|
|
--k3s-arg "--datastore-endpoint=mysql://prole:$PROLE_PASSWD\@tcp($HOST_IP:3306)/k3s@server:*"
|