dtoro/oikos
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

bootstrap.sh: auto-call refresh-creds when the client is a PAT recipient

Browse Source 
End of enrollment, if secrets/gitea-pat.yaml is decryptable with the
just-issued age key (i.e. the operator has already run --finalize-pubkey
from another client), upgrade /etc/homelab-context/git-credentials from
the read-only bootstrap PAT to the write-scoped one. Best-effort: fails
silently if not yet a recipient, with a clear hint about what to do next.

Removes the post-bootstrap manual 'homelab refresh-creds' step from the
common flow; falls back to the documented one-liner for first-bootstrap
clients.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
root
2026-05-20 21:14:03 +02:00
parent 6ed04dd1b0
commit e7a74f795d
1 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
bootstrap.sh
View File

@@ -264,6 +264,26 @@ esac
run "ln -sfn '$CLONE_DIR/AGENTS.md' '$AGENTS_LINK'"
echo "[bootstrap] linked AGENTS.md → $AGENTS_LINK"
# -------- auto-upgrade to write-scoped Gitea PAT --------
# After enrollment, if this client is already a recipient on
# secrets/gitea-pat.yaml (i.e. the operator has run
# `homelab client add --finalize-pubkey` from another client), swap the
# read-only bootstrap PAT for the write-scoped one. Best-effort: fails
# silently if the client isn't yet a recipient — the operator just re-runs
# bootstrap or `homelab refresh-creds` later.
if [ "$NO_SECRETS" -eq 0 ] && [ "$DRY_RUN" -eq 0 ] \
&& command -v sops >/dev/null 2>&1 \
&& [ -f "$CLONE_DIR/secrets/gitea-pat.yaml" ]; then
if /usr/local/bin/homelab refresh-creds >/tmp/homelab-refresh-creds.log 2>&1; then
echo "[bootstrap] refresh-creds: write-scoped Gitea PAT installed"
else
echo "[bootstrap] refresh-creds: skipped (this client isn't yet a recipient"
echo " on secrets/gitea-pat.yaml — run 'homelab client add"
echo " $HNAME --finalize-pubkey <age...>' from an existing client,"
echo " then re-run bootstrap or 'homelab refresh-creds')"
fi
fi
# -------- MCP wiring --------
if [ "$WITH_MCP" -eq 1 ]; then
# Pick the right user's home — when invoked via sudo, SUDO_USER is set.