58 lines
1.7 KiB
Bash
Executable File
58 lines
1.7 KiB
Bash
Executable File
#!/bin/sh
|
|
# One-shot: populate Infisical with oikos secrets from host .env.
|
|
# Runs on the deploy host (mac-mini) where docker-compose reads .env.
|
|
# Uses the oikos binary from the repo to talk to Infisical on localhost:8080.
|
|
#
|
|
# Usage: ./scripts/seed-secrets.sh
|
|
#
|
|
# Safe to re-run (set is idempotent).
|
|
|
|
set -e
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
REPO_DIR="${REPO_DIR:-$SCRIPT_DIR/..}"
|
|
OIKOS_BIN="${OIKOS_BIN:-$REPO_DIR/bin/oikos}"
|
|
|
|
export OIKOS_INFISICAL_SITE_URL="${OIKOS_INFISICAL_SITE_URL:-http://localhost:8080}"
|
|
export OIKOS_INFISICAL_ENV="${OIKOS_INFISICAL_ENV:-dev}"
|
|
|
|
echo "=== seed-secrets: $(date) ==="
|
|
|
|
if [ ! -x "$OIKOS_BIN" ]; then
|
|
echo "Building oikos binary..."
|
|
(cd "$REPO_DIR" && go build -o "$OIKOS_BIN" ./cmd/oikos/)
|
|
fi
|
|
|
|
set_count=0
|
|
skip_count=0
|
|
fail_count=0
|
|
|
|
seed_key() {
|
|
key="$1"
|
|
env_var="$2"
|
|
value="$(eval echo \"\${$env_var:-}\")"
|
|
if [ -z "$value" ]; then
|
|
echo "SKIP: $key ($env_var empty/missing)"
|
|
skip_count=$((skip_count + 1))
|
|
return
|
|
fi
|
|
if "$OIKOS_BIN" secret set "$key" "$value" 2>/dev/null; then
|
|
echo "SET: $key"
|
|
set_count=$((set_count + 1))
|
|
else
|
|
echo "FAIL: $key"
|
|
fail_count=$((fail_count + 1))
|
|
fi
|
|
}
|
|
|
|
seed_key "matrix_token" "OIKOS_MATRIX_TOKEN"
|
|
seed_key "approval_hmac-secret" "OIKOS_APPROVAL_HMAC_SECRET"
|
|
seed_key "mcp_bearer-token" "OIKOS_MCP_BEARER_TOKEN"
|
|
seed_key "api_token" "OIKOS_API_TOKEN"
|
|
seed_key "oidc_client-secret" "OIKOS_OIDC_CLIENT_SECRET"
|
|
seed_key "openrouter_api-key" "OPENROUTER_API_KEY"
|
|
seed_key "webhook_hmac-secret" "WEBHOOK_HMAC_SECRET"
|
|
|
|
echo ""
|
|
echo "seed-secrets complete: $set_count set, $skip_count skipped, $fail_count failed"
|