Build local product stack with Vault-managed secrets (#42)

dev/local.py

@@ -0,0 +1,47 @@
+#!/usr/bin/env python3
+"""Local stack lifecycle. Requires Python 3 and Docker Compose."""
+import sys
+from bootstrap import up
+from vault import Vault
+
+
+def main():
+    vault = Vault()
+    if len(sys.argv) == 2 and sys.argv[1] == 'up':
+        import fcntl
+        from vault import STATE
+        STATE.mkdir(parents=True, exist_ok=True, mode=0o700)
+        with (STATE / 'bootstrap.lock').open('w') as lock:
+            try:
+                fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
+            except BlockingIOError:
+                raise RuntimeError('Another local bootstrap is running') from None
+            up(vault)
+    elif len(sys.argv) == 2 and sys.argv[1] == 'verify':
+        from verify import verify
+        vault.existing()
+        verify(vault)
+    elif len(sys.argv) == 2 and sys.argv[1] == 'verify-infra':
+        from verify import infrastructure
+        vault.existing()
+        infrastructure(vault)
+    elif len(sys.argv) == 2 and sys.argv[1] == 'email':
+        import getpass
+        vault.existing()
+        address = input('Verified Resend sender address: ').strip()
+        key = getpass.getpass('Resend API key (hidden): ').strip()
+        if not key or '@' not in address:
+            raise RuntimeError('A key and sender address are required')
+        vault.put('email', {'driver': 'resend', 'api_key': key,
+                           'sender_address': address, 'sender_name': 'SXCHNGE'})
+        print('Email configuration saved in Vault. Run make up.')
+    else:
+        raise RuntimeError('Usage: python3 dev/local.py up|verify|verify-infra|email')
+
+
+if __name__ == '__main__':
+    try:
+        main()
+    except (RuntimeError, OSError) as error:
+        print('Local development setup failed: ' + str(error), file=sys.stderr)
+        sys.exit(1)