127 lines
6.8 KiB
Bash
127 lines
6.8 KiB
Bash
initialize() {
|
|
attempt=0
|
|
until initialized=$(vault sys/init | jq -er '.initialized|tostring'); do
|
|
attempt=$((attempt+1)); [ "$attempt" -lt 90 ] || fail 'Vault did not start'; sleep 1
|
|
done
|
|
if [ "$initialized" = false ]; then
|
|
[ ! -e "$STATE/admin/init.json" ] || fail 'Vault data missing but bootstrap material exists; restore matching volume or reset both'
|
|
printf '{"secret_shares":1,"secret_threshold":1}' | vault sys/init POST | write "$STATE/admin/init.json"
|
|
fi
|
|
existing
|
|
jq -r '.keys_base64[0]' "$STATE/admin/init.json" | write "$STATE/vault/unseal" 444
|
|
attempt=0
|
|
until vault sys/seal-status | jq -e '.sealed==false' >/dev/null; do
|
|
attempt=$((attempt+1)); [ "$attempt" -lt 60 ] || fail 'Vault did not unseal'; sleep 1
|
|
done
|
|
}
|
|
mounts() {
|
|
vault sys/mounts > "$WORK/mounts"
|
|
for name in kv database; do
|
|
if ! jq -e --arg key "$name/" 'has($key)' < "$WORK/mounts" >/dev/null; then
|
|
if ! jq -e --arg key "$name/" '.data|has($key)' < "$WORK/mounts" >/dev/null; then
|
|
jq -n --arg name "$name" '{type:$name} + (if $name=="kv" then {options:{version:"2"}} else {} end)' | vault "sys/mounts/$name" POST >/dev/null
|
|
fi
|
|
fi
|
|
done
|
|
if ! vault sys/auth | jq -e '.data|has("approle/")' >/dev/null; then
|
|
printf '{"type":"approle"}' | vault sys/auth/approle POST >/dev/null
|
|
fi
|
|
}
|
|
provision_mongo() {
|
|
if [ "$(kv infrastructure/mongo/bootstrap)" = null ]; then
|
|
random > "$WORK/password"; random 384 > "$WORK/keyfile"; random > "$WORK/manager"
|
|
jq -n --rawfile password "$WORK/password" --rawfile keyfile "$WORK/keyfile" --rawfile manager "$WORK/manager" '{password:($password|rtrimstr("\n")),keyfile:($keyfile|rtrimstr("\n")),manager_password:($manager|rtrimstr("\n"))}' | put infrastructure/mongo/bootstrap
|
|
fi
|
|
kv infrastructure/mongo/bootstrap > "$WORK/mongo-secret"
|
|
jq -r '.password' "$WORK/mongo-secret" | write "$STATE/mongo/password"
|
|
jq -r '.keyfile' "$WORK/mongo-secret" | write "$STATE/mongo/keyfile"
|
|
compose up -d mongo
|
|
admin_auth > "$WORK/admin.js"
|
|
attempt=0
|
|
while :; do
|
|
if { cat "$WORK/admin.js"; printf 'try {rs.status()} catch(e) {if(e.code===94) rs.initiate({_id:"rs0",members:[{_id:0,host:"mongo:27017"}]}); else throw e;} print(db.hello().isWritablePrimary);'; } | mongo > "$WORK/primary" && grep -q true "$WORK/primary"; then break; fi
|
|
attempt=$((attempt+1)); [ "$attempt" -lt 90 ] || fail 'Mongo replica set did not become primary'; sleep 2
|
|
done
|
|
if [ "$(vault database/config/mongo GET yes)" = null ]; then
|
|
{ cat "$WORK/admin.js"; jq -r '"if(!admin.getUser(\"vault-manager\")) admin.createUser({user:\"vault-manager\",pwd:"+(.manager_password|tojson)+",roles:[{role:\"userAdminAnyDatabase\",db:\"admin\"}]});"' "$WORK/mongo-secret"; } | mongo >/dev/null || fail 'Mongo manager provisioning failed'
|
|
jq '{plugin_name:"mongodb-database-plugin",allowed_roles:["bff","notifications"],connection_url:"mongodb://{{username}}:{{password}}@mongo:27017/admin?replicaSet=rs0",username:"vault-manager",password:.manager_password}' "$WORK/mongo-secret" | vault database/config/mongo POST >/dev/null
|
|
printf '{}' | vault database/rotate-root/mongo POST >/dev/null
|
|
fi
|
|
for role in bff notifications; do
|
|
database=sxchnge; [ "$role" != notifications ] || database=sxchnge_notifications
|
|
jq -n --arg database "$database" '{db_name:"mongo",creation_statements:({db:"admin",roles:[{role:"readWrite",db:$database}]}|tojson),default_ttl:"1h",max_ttl:"24h"}' | vault "database/roles/$role" POST >/dev/null
|
|
done
|
|
{ cat "$WORK/admin.js"; cat infra/local/mongo/mongo-client.js; } | mongo >/dev/null || fail 'Browser client provisioning failed'
|
|
}
|
|
provision_agents() {
|
|
for service in bff notifications nats; do
|
|
directory="$STATE/agents/$service"
|
|
mkdir -p "$directory"; chmod 755 "$directory"
|
|
case "$service" in
|
|
bff) paths='services/bff/jwt';;
|
|
notifications) paths='infrastructure/nats/auth services/notifications/email/resend';;
|
|
nats) paths=infrastructure/nats/auth;;
|
|
esac
|
|
: > "$WORK/policy"
|
|
for path in $paths; do printf 'path "kv/data/%s" { capabilities = ["read"] }\n' "$path" >> "$WORK/policy"; done
|
|
if [ "$service" != nats ]; then printf 'path "database/creds/%s" { capabilities = ["read"] }\n' "$service" >> "$WORK/policy"; fi
|
|
jq -n --rawfile policy "$WORK/policy" '{policy:$policy}' | vault "sys/policies/acl/$service" POST >/dev/null
|
|
jq -n --arg service "$service" '{token_policies:[$service],token_period:"1h",secret_id_ttl:"0",secret_id_num_uses:0}' | vault "auth/approle/role/$service" POST >/dev/null
|
|
vault "auth/approle/role/$service/role-id" | jq -r '.data.role_id' | write "$directory/role-id" 444
|
|
if [ ! -f "$directory/secret-id" ]; then
|
|
printf '{}' | vault "auth/approle/role/$service/secret-id" POST | jq -r '.data.secret_id' | write "$directory/secret-id" 444
|
|
fi
|
|
if ! cmp -s "infra/local/vault/$service.hcl" "$directory/config.hcl"; then
|
|
cat "infra/local/vault/$service.hcl" | write "$directory/config.hcl" 444
|
|
if compose ps --status running --services "$service" | grep -qx "$service"; then
|
|
compose up -d --no-deps --force-recreate --wait --wait-timeout 120 "$service"
|
|
fi
|
|
fi
|
|
done
|
|
}
|
|
up() {
|
|
[ -f "$STATE/images.env" ] || fail 'Run make build before make up'
|
|
exec 9> "$STATE/bootstrap.lock"
|
|
flock -n 9 || fail 'Another local bootstrap is running'
|
|
mkdir -p "$STATE/vault"; chmod 755 "$STATE/vault"
|
|
compose up -d vault
|
|
# On first bootstrap Compose creates the network after this tool container starts.
|
|
if ! docker inspect "$HOSTNAME" --format '{{json .NetworkSettings.Networks}}' | jq -e 'has("sxchnge-local_default")' >/dev/null; then
|
|
docker network connect sxchnge-local_default "$HOSTNAME"
|
|
fi
|
|
initialize
|
|
mounts
|
|
migrate_secrets
|
|
for path in infrastructure/nats/auth services/bff/jwt; do
|
|
if [ "$(kv "$path")" = null ]; then
|
|
field=token; [ "$path" != services/bff/jwt ] || field=jwt
|
|
random | jq -Rs --arg field "$field" '{($field):rtrimstr("\n")}' | put "$path"
|
|
fi
|
|
done
|
|
printf '{"api_key":""}' | ensure services/notifications/email/resend
|
|
provision_mongo
|
|
provision_agents
|
|
compose up -d --wait --wait-timeout 120 nats
|
|
retire_secrets
|
|
normalize_email_secret
|
|
kv services/notifications/email/resend | email_valid || fail 'Vault kv/services/notifications/email/resend needs api_key. Run make email; configure the verified sender in infra/local/notifications/runtime.yml, then make build && make up.'
|
|
compose up -d --wait --wait-timeout 180
|
|
export_ca
|
|
echo 'Local stack ready: https://localhost:5126; Vault: http://127.0.0.1:18200'
|
|
}
|
|
email() {
|
|
existing
|
|
printf 'Resend API key (hidden): ' >&2
|
|
tty_state=$(stty -g)
|
|
trap 'stty "$tty_state"; cleanup' EXIT
|
|
stty -echo
|
|
IFS= read -r key
|
|
stty "$tty_state"
|
|
printf '\n' >&2
|
|
[ -n "$key" ] || fail 'A key is required'
|
|
printf '%s' "$key" > "$WORK/email-key"
|
|
normalize_email_secret
|
|
jq -n --rawfile key "$WORK/email-key" '{api_key:$key}' | put services/notifications/email/resend
|
|
echo 'API key saved in Vault. Set the verified sender in infra/local/notifications/runtime.yml, then make build && make up.'
|
|
}
|