0.27.1 — flat Infisical keys (_), seed-secrets.sh in deploy, plist cleanup, .env strip

scripts/seed-secrets.sh

@@ -0,0 +1,44 @@
+#!/bin/sh
+# One-shot: populate Infisical with oikos secrets from env vars.
+# Designed to run inside the oikos-api container where Infisical is reachable.
+# Safe to re-run (set is idempotent).
+#
+# Usage: docker exec oikos-api-1 /opt/oikos/scripts/seed-secrets.sh
+#
+# Secrets are read from the container environment (set via docker-compose).
+# If a secret is already in Infisical, it is updated in place.
+
+set -e
+
+echo "=== seed-secrets: $(date) ==="
+
+KEYS="
+matrix_token:${OIKOS_MATRIX_TOKEN:-}
+approval_hmac-secret:${OIKOS_APPROVAL_HMAC_SECRET:-}
+mcp_bearer-token:${OIKOS_MCP_BEARER_TOKEN:-}
+api_token:${OIKOS_API_TOKEN:-}
+oidc_client-secret:${OIKOS_OIDC_CLIENT_SECRET:-}
+openrouter_api-key:${OPENROUTER_API_KEY:-}
+webhook_hmac-secret:${WEBHOOK_HMAC_SECRET:-}
+"
+
+set_count=0
+skip_count=0
+
+echo "$KEYS" | while IFS=: read -r key value; do
+    [ -z "$key" ] && continue
+    if [ -z "$value" ]; then
+        echo "SKIP: $key (env var empty/missing)"
+        skip_count=$((skip_count + 1))
+        continue
+    fi
+    if oikos secret set "$key" "$value" 2>/dev/null; then
+        echo "SET:  $key"
+        set_count=$((set_count + 1))
+    else
+        echo "FAIL: $key"
+    fi
+done
+
+echo ""
+echo "seed-secrets complete: $set_count set, $skip_count skipped"