69 lines
2.0 KiB
Bash
Executable File
69 lines
2.0 KiB
Bash
Executable File
#!/bin/sh
|
|
# One-shot: populate Infisical with oikos secrets from container env.
|
|
# Only runs if Infisical is empty (first bootstrap). Safe to re-run.
|
|
#
|
|
# Usage: ./scripts/seed-secrets.sh
|
|
|
|
set -e
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
REPO_DIR="${REPO_DIR:-$SCRIPT_DIR/..}"
|
|
COMPOSE="docker compose -f $REPO_DIR/docker-compose.yml"
|
|
|
|
echo "=== seed-secrets: $(date) ==="
|
|
|
|
# Skip if Infisical already has secrets (avoid overwriting real values
|
|
# with dev defaults from docker-compose).
|
|
existing=$($COMPOSE exec -T api /oikos secret list 2>/dev/null | grep -c . || echo 0)
|
|
if [ "$existing" -gt 3 ]; then
|
|
echo "SKIP: Infisical already has $existing secrets (bootstrap complete)"
|
|
exit 0
|
|
fi
|
|
|
|
echo "Infisical has $existing secrets — seeding..."
|
|
|
|
set_count=0
|
|
skip_count=0
|
|
fail_count=0
|
|
|
|
get_container_env() {
|
|
service="$1"
|
|
var="$2"
|
|
$COMPOSE exec -T "$service" printenv "$var" 2>/dev/null || true
|
|
}
|
|
|
|
seed_key() {
|
|
key="$1"
|
|
value="$2"
|
|
if [ -z "$value" ]; then
|
|
echo "SKIP: $key (empty)"
|
|
skip_count=$((skip_count + 1))
|
|
return
|
|
fi
|
|
if $COMPOSE exec -T api oikos secret set "$key" "$value" 2>/dev/null; then
|
|
echo "SET: $key"
|
|
set_count=$((set_count + 1))
|
|
else
|
|
echo "FAIL: $key"
|
|
fail_count=$((fail_count + 1))
|
|
fi
|
|
}
|
|
|
|
matrix_token="$(get_container_env notifier OIKOS_MATRIX_TOKEN)"
|
|
approval_hmac="$(get_container_env notifier OIKOS_APPROVAL_HMAC_SECRET)"
|
|
mcp_token="$(get_container_env api OIKOS_MCP_BEARER_TOKEN)"
|
|
openrouter_key="$(get_container_env nomos OPENROUTER_API_KEY)"
|
|
webhook_hmac="$(get_container_env api WEBHOOK_HMAC_SECRET 2>/dev/null)"
|
|
|
|
api_token="$mcp_token"
|
|
|
|
seed_key "matrix_token" "$matrix_token"
|
|
seed_key "approval_hmac-secret" "$approval_hmac"
|
|
seed_key "mcp_bearer-token" "$mcp_token"
|
|
seed_key "api_token" "$api_token"
|
|
seed_key "openrouter_api-key" "$openrouter_key"
|
|
seed_key "webhook_hmac-secret" "$webhook_hmac"
|
|
|
|
echo ""
|
|
echo "seed-secrets complete: $set_count set, $skip_count skipped, $fail_count failed"
|