Organize local infrastructure and Vault secrets by service ownership

infra/local/tools.sh

@@ -0,0 +1,25 @@
+#!/bin/sh
+# Host entry point: only POSIX shell and Docker are required.
+set -eu
+cd "$(dirname "$0")/../.."
+case "${1:-}" in
+ build)
+  docker pull docker:cli
+  ref=$(docker image inspect docker:cli --format '{{index .RepoDigests 0}}')
+  case "$ref" in docker@sha256:*) ;; *) echo 'Cannot pin stable Docker CLI image' >&2; exit 1;; esac
+  docker build --pull --build-arg "DOCKER_IMAGE=$ref" -f infra/images/tools.Dockerfile -t sxchnge-local/tools:dev infra/images
+  exit
+  ;;
+esac
+docker image inspect sxchnge-local/tools:dev >/dev/null 2>&1 || { echo 'Run make build first' >&2; exit 1; }
+endpoint=${DOCKER_HOST:-$(docker context inspect --format '{{.Endpoints.docker.Host}}')}
+case "$endpoint" in unix://*) socket=${endpoint#unix://};; *) echo 'Local tooling requires a local Unix Docker socket' >&2; exit 1;; esac
+network_args=
+if docker network inspect sxchnge-local_default >/dev/null 2>&1; then network_args='--network sxchnge-local_default'; fi
+terminal_args=-i
+if [ "${1:-}" = email ]; then terminal_args=-it; fi
+# These two argument lists contain only fixed strings controlled above.
+# shellcheck disable=SC2086
+exec docker run --rm $terminal_args $network_args -e "LOCAL_UID=$(id -u)" -e "LOCAL_GID=$(id -g)" \
+ -v "$socket:/var/run/docker.sock" -v "$PWD:$PWD" -w "$PWD" \
+ sxchnge-local/tools:dev sh infra/local/scripts/dispatch.sh "$@"