69 lines
1.7 KiB
Bash
Executable File
69 lines
1.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
NAMESPACE="la-huasca"
|
|
SECRET_NAME="la-huasca-db-secrets"
|
|
PROTECTED_FILE="$HOME/.lahuasca-db-pass.enc"
|
|
PIN="78963"
|
|
|
|
generate_password() {
|
|
openssl rand -base64 48 | tr -dc 'a-zA-Z0-9' | head -c 32
|
|
}
|
|
|
|
decrypt_password() {
|
|
openssl enc -aes-256-cbc -d -salt -pbkdf2 -iter 100000 -pass pass:"$PIN" -in "$PROTECTED_FILE" | tr -d '\n'
|
|
}
|
|
|
|
# Generate a secure random password if it doesn't already exist
|
|
if [ -f "$PROTECTED_FILE" ]; then
|
|
echo "Protected password file already exists at $PROTECTED_FILE"
|
|
echo "Run './deploy-db.sh reveal' to view it."
|
|
else
|
|
PASSWORD=***
|
|
if [ -z "$PASSWORD" ]; then
|
|
echo "Failed to generate password. Is openssl installed?"
|
|
exit 1
|
|
fi
|
|
echo -n "$PASSWORD" | openssl enc -aes-256-cbc -salt -pbkdf2 -iter 100000 -pass pass:"$PIN" -out "$PROTECTED_FILE"
|
|
echo "Generated secure password and saved it to $PROTECTED_FILE"
|
|
fi
|
|
|
|
if [ "${1:-}" = "reveal" ]; then
|
|
echo "Enter PIN to reveal the database password:"
|
|
read -s USER_PIN
|
|
if [ "$USER_PIN" != "$PIN" ]; then
|
|
echo "Incorrect PIN."
|
|
exit 1
|
|
fi
|
|
PASSWORD=***
|
|
if [ -z "$PASSWORD" ]; then
|
|
echo "Failed to decrypt password."
|
|
exit 1
|
|
fi
|
|
echo "Database password: $PASSWORD"
|
|
exit 0
|
|
fi
|
|
|
|
# Read password for deployment
|
|
PASSWORD=***
|
|
if [ -z "$PASSWORD" ]; then
|
|
echo "Failed to decrypt password. Protected file may be corrupt."
|
|
exit 1
|
|
fi
|
|
|
|
cat <<EOF | kubectl apply -f -
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: $SECRET_NAME
|
|
namespace: $NAMESPACE
|
|
type: Opaque
|
|
stringData:
|
|
POSTGRES_USER: lahuasca
|
|
POSTGRES_PASSWORD: "$PASSWORD"
|
|
POSTGRES_DB: lahuasca
|
|
DATABASE_URL: "postgres://lahuasca:${PASSWORD}@postgres:5432/lahuasca"
|
|
EOF
|
|
|
|
echo "Database secret updated in namespace $NAMESPACE"
|