cleanup: archive stale secrets/ + secrets-issuance/, add Infisical bootstrap script, update SOPS paths to archive/
This commit is contained in:
138
scripts/bootstrap-infisical.sh
Executable file
138
scripts/bootstrap-infisical.sh
Executable file
@@ -0,0 +1,138 @@
|
||||
#!/bin/bash
|
||||
# Bootstrap Infisical from zero.
|
||||
# Run after: docker compose up -d postgres
|
||||
# Produces: .env with all OIKOS_INFISICAL_* values, admin creds in .infisical-credentials
|
||||
set -euo pipefail
|
||||
|
||||
INFISICAL_URL="${INFISICAL_URL:-http://localhost:8080}"
|
||||
ADMIN_EMAIL="${ADMIN_EMAIL:-oikos@hubris.network}"
|
||||
ADMIN_PASS="${ADMIN_PASS:-oikos-admin-$(openssl rand -hex 4)}"
|
||||
PROJECT_NAME="${PROJECT_NAME:-oikos}"
|
||||
ORG_NAME="${ORG_NAME:-Oikos}"
|
||||
|
||||
# ── 1. Generate keys ───────────────────────────────────────────────
|
||||
echo "=== [1/6] Generating keys ==="
|
||||
ENCRYPTION_KEY=$(python3 -c "import secrets, string; print(''.join(secrets.choice(string.ascii_letters+string.digits) for _ in range(32)))")
|
||||
JWT_SIGNUP=$(openssl rand -hex 32)
|
||||
JWT_REFRESH=$(openssl rand -hex 32)
|
||||
JWT_AUTH=$(openssl rand -hex 32)
|
||||
JWT_SERVICE=$(openssl rand -hex 32)
|
||||
JWT_MFA=$(openssl rand -hex 32)
|
||||
JWT_PROVIDER=$(openssl rand -hex 32)
|
||||
|
||||
# ── 2. Write .env ──────────────────────────────────────────────────
|
||||
cat > .env <<EOF
|
||||
INFISICAL_ENCRYPTION_KEY=$ENCRYPTION_KEY
|
||||
INFISICAL_JWT_SIGNUP_SECRET=$JWT_SIGNUP
|
||||
INFISICAL_JWT_REFRESH_SECRET=$JWT_REFRESH
|
||||
INFISICAL_JWT_AUTH_SECRET=$JWT_AUTH
|
||||
INFISICAL_JWT_SERVICE_SECRET=$JWT_SERVICE
|
||||
INFISICAL_JWT_MFA_SECRET=$JWT_MFA
|
||||
INFISICAL_JWT_PROVIDER_SECRET=$JWT_PROVIDER
|
||||
INFISICAL_SITE_URL=$INFISICAL_URL
|
||||
EOF
|
||||
|
||||
# ── 3. Create DB + start services ──────────────────────────────────
|
||||
echo "=== [2/6] Creating infisical database ==="
|
||||
docker compose exec -T postgres psql -U oikos -d postgres -v ON_ERROR_STOP=1 <<SQL 2>/dev/null || true
|
||||
DROP DATABASE IF EXISTS infisical;
|
||||
CREATE DATABASE infisical;
|
||||
SQL
|
||||
|
||||
echo "=== [3/6] Starting Infisical + Redis ==="
|
||||
docker compose --profile infisical up infisical redis -d --wait 2>&1 | tail -2
|
||||
|
||||
# Wait for healthy
|
||||
for i in $(seq 1 30); do
|
||||
if curl -sf "$INFISICAL_URL/api/status" > /dev/null 2>&1; then break; fi
|
||||
sleep 2
|
||||
done
|
||||
echo "Infisical ready"
|
||||
|
||||
# ── 4. Create admin ────────────────────────────────────────────────
|
||||
echo "=== [4/6] Creating admin account ==="
|
||||
SIGNUP=$(curl -s -X POST "$INFISICAL_URL/api/v1/admin/signup" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"email\":\"$ADMIN_EMAIL\",\"password\":\"$ADMIN_PASS\",\"firstName\":\"Oikos\",\"lastName\":\"Admin\",\"organizationName\":\"$ORG_NAME\"}")
|
||||
ORG_ID=$(echo "$SIGNUP" | python3 -c "import sys,json; print(json.load(sys.stdin)['organization']['id'])")
|
||||
USER_TOKEN=$(echo "$SIGNUP" | python3 -c "import sys,json; print(json.load(sys.stdin)['token'])")
|
||||
echo "Admin created, org=$ORG_ID"
|
||||
|
||||
# ── 5. Get org-scoped token ────────────────────────────────────────
|
||||
ORG_TOKEN=$(curl -s -X POST "$INFISICAL_URL/api/v3/auth/select-organization" \
|
||||
-H "Authorization: Bearer $USER_TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"organizationId\":\"$ORG_ID\"}" | python3 -c "import sys,json; print(json.load(sys.stdin)['token'])")
|
||||
|
||||
# ── 6. Create project + identity ───────────────────────────────────
|
||||
echo "=== [5/6] Creating project + machine identity ==="
|
||||
PROJECT=$(curl -s -X POST "$INFISICAL_URL/api/v1/projects" \
|
||||
-H "Authorization: Bearer $ORG_TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"projectName\":\"$PROJECT_NAME\",\"slug\":\"$PROJECT_NAME\"}")
|
||||
PROJECT_ID=$(echo "$PROJECT" | python3 -c "import sys,json; print(json.load(sys.stdin)['project']['id'])")
|
||||
echo "Project: $PROJECT_NAME ($PROJECT_ID)"
|
||||
|
||||
# Create machine identity
|
||||
IDENTITY=$(curl -s -X POST "$INFISICAL_URL/api/v1/identities" \
|
||||
-H "Authorization: Bearer $ORG_TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"name\":\"$PROJECT_NAME-api\",\"role\":\"admin\",\"organizationId\":\"$ORG_ID\",\"projectIds\":[\"$PROJECT_ID\"]}")
|
||||
IDENTITY_ID=$(echo "$IDENTITY" | python3 -c "import sys,json; print(json.load(sys.stdin)['identity']['id'])")
|
||||
echo "Identity: $PROJECT_NAME-api ($IDENTITY_ID)"
|
||||
|
||||
# Attach Universal Auth
|
||||
UA=$(curl -s -X POST "$INFISICAL_URL/api/v1/auth/universal-auth/identities/$IDENTITY_ID" \
|
||||
-H "Authorization: Bearer $ORG_TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"clientIdTtl":0,"clientSecretTtl":0,"accessTokenTtl":2592000,"accessTokenMaxTtl":2592000,"accessTokenNumUsesLimit":0}')
|
||||
CLIENT_ID=$(echo "$UA" | python3 -c "import sys,json; print(json.load(sys.stdin)['identityUniversalAuth']['clientId'])")
|
||||
echo "UA attached, clientId=$CLIENT_ID"
|
||||
|
||||
# Create client secret
|
||||
SECRET=$(curl -s -X POST "$INFISICAL_URL/api/v1/auth/universal-auth/identities/$IDENTITY_ID/client-secrets" \
|
||||
-H "Authorization: Bearer $ORG_TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"description":"default","clientSecretTtl":0,"clientSecretNumUsesLimit":0}')
|
||||
CLIENT_SECRET=$(echo "$SECRET" | python3 -c "import sys,json; print(json.load(sys.stdin)['clientSecret'])")
|
||||
echo "Client secret created"
|
||||
|
||||
# Add identity to project
|
||||
curl -s -X POST "$INFISICAL_URL/api/v1/projects/$PROJECT_ID/memberships/identities/$IDENTITY_ID" \
|
||||
-H "Authorization: Bearer $ORG_TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"roles":[{"role":"admin","isTemporary":false}]}' > /dev/null
|
||||
echo "Identity added to project"
|
||||
|
||||
# ── 7. Write credentials ──────────────────────────────────────────
|
||||
echo "=== [6/6] Writing credentials ==="
|
||||
cat >> .env <<EOF
|
||||
OIKOS_INFISICAL_SITE_URL=http://infisical:8080
|
||||
OIKOS_INFISICAL_CLIENT_ID=$CLIENT_ID
|
||||
OIKOS_INFISICAL_CLIENT_SECRET=$CLIENT_SECRET
|
||||
OIKOS_INFISICAL_PROJECT_ID=$PROJECT_ID
|
||||
OIKOS_INFISICAL_ENV=dev
|
||||
OIKOS_SECRET_BACKEND=infisical
|
||||
EOF
|
||||
|
||||
cat > .infisical-credentials <<EOF
|
||||
# Infisical admin credentials (generated $(date -Iseconds))
|
||||
URL: $INFISICAL_URL
|
||||
Admin: $ADMIN_EMAIL / $ADMIN_PASS
|
||||
Organization: $ORG_ID
|
||||
Project: $PROJECT_NAME ($PROJECT_ID)
|
||||
Identity: $PROJECT_NAME-api ($IDENTITY_ID)
|
||||
Client ID: $CLIENT_ID
|
||||
Client Secret: $CLIENT_SECRET
|
||||
EOF
|
||||
|
||||
echo ""
|
||||
echo "============================================"
|
||||
echo "Infisical bootstrapped."
|
||||
echo "Admin: $ADMIN_EMAIL / $ADMIN_PASS"
|
||||
echo "Project: $PROJECT_NAME ($PROJECT_ID)"
|
||||
echo "UA: $CLIENT_ID"
|
||||
echo ""
|
||||
echo ".env and .infisical-credentials written."
|
||||
echo "Next: oikos secret migrate (if SOPS secrets exist)"
|
||||
echo "============================================"
|
||||
Reference in New Issue
Block a user