Add database integration, auth API, admin/user portals, and deploy-db.sh

2026-06-27 16:40:58 -05:00
parent 26559d4cf8
commit cc59177a74
25 changed files with 1423 additions and 118 deletions
@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+NAMESPACE="la-huasca"
+SECRET_NAME="la-huasca-db-secrets"
+PROTECTED_FILE="$HOME/.lahuasca-db-pass.enc"
+PIN="78963"
+
+generate_password() {
+  openssl rand -base64 48 | tr -dc 'a-zA-Z0-9' | head -c 32
+}
+
+decrypt_password() {
+  openssl enc -aes-256-cbc -d -salt -pbkdf2 -iter 100000 -pass pass:"$PIN" -in "$PROTECTED_FILE" | tr -d '\n'
+}
+
+# Generate a secure random password if it doesn't already exist
+if [ -f "$PROTECTED_FILE" ]; then
+  echo "Protected password file already exists at $PROTECTED_FILE"
+  echo "Run './deploy-db.sh reveal' to view it."
+else
+  PASSWORD=***
+  if [ -z "$PASSWORD" ]; then
+    echo "Failed to generate password. Is openssl installed?"
+    exit 1
+  fi
+  echo -n "$PASSWORD" | openssl enc -aes-256-cbc -salt -pbkdf2 -iter 100000 -pass pass:"$PIN" -out "$PROTECTED_FILE"
+  echo "Generated secure password and saved it to $PROTECTED_FILE"
+fi
+
+if [ "${1:-}" = "reveal" ]; then
+  echo "Enter PIN to reveal the database password:"
+  read -s USER_PIN
+  if [ "$USER_PIN" != "$PIN" ]; then
+    echo "Incorrect PIN."
+    exit 1
+  fi
+  PASSWORD=***
+  if [ -z "$PASSWORD" ]; then
+    echo "Failed to decrypt password."
+    exit 1
+  fi
+  echo "Database password: $PASSWORD"
+  exit 0
+fi
+
+# Read password for deployment
+PASSWORD=***
+if [ -z "$PASSWORD" ]; then
+  echo "Failed to decrypt password. Protected file may be corrupt."
+  exit 1
+fi
+
+cat <<EOF | kubectl apply -f -
+apiVersion: v1
+kind: Secret
+metadata:
+  name: $SECRET_NAME
+  namespace: $NAMESPACE
+type: Opaque
+stringData:
+  POSTGRES_USER: lahuasca
+  POSTGRES_PASSWORD: "$PASSWORD"
+  POSTGRES_DB: lahuasca
+EOF
+
+echo "Database secret updated in namespace $NAMESPACE"