419ab475b1
Two additions: 1. secrets-issuance backup: daily timer snapshots /var/lib/secrets-issuance to /mnt/library/.secrets-issuance-backup/ as a date-stamped tar.gz, keeping the last 14 days. Closes the catastrophic-fail-mode where an LXC 105 loss wipes every client's age key with no recovery path. Caveat: privileged LXCs that mount /mnt/library can read the backup (root-uid maps to host root); encrypted-tarball variant is a future refinement. 2. homelab doctor: 10 invariant checks for an enrolled client — clone present, sync timer/launchd job active, age key perms, CLI symlinked, AGENTS.md linked, inventory entry exists, MCP reachable, secrets /health responds, sops canary decrypts, git creds present. Returns nonzero on any 'fail'. Useful after enrollment or whenever something smells off. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
67 lines
2.5 KiB
Bash
Executable File
67 lines
2.5 KiB
Bash
Executable File
#!/bin/bash
|
|
# Install/update secrets-issuance on LXC 105 (apps). Idempotent.
|
|
set -euo pipefail
|
|
|
|
REPO_DIR=${REPO_DIR:-/opt/secrets-issuance}
|
|
|
|
cd "$REPO_DIR"
|
|
echo "[deploy] git pull"
|
|
git pull --ff-only
|
|
|
|
echo "[deploy] ensure python venv + deps"
|
|
if [ ! -d /opt/secrets-issuance/.venv ]; then
|
|
python3 -m venv /opt/secrets-issuance/.venv
|
|
fi
|
|
/opt/secrets-issuance/.venv/bin/pip install --quiet --upgrade pip
|
|
/opt/secrets-issuance/.venv/bin/pip install --quiet pyyaml
|
|
|
|
echo "[deploy] verify dependencies (age, shred)"
|
|
command -v age-keygen >/dev/null || { echo "age-keygen not installed: apt install -y age" >&2; exit 1; }
|
|
command -v shred >/dev/null || { echo "shred not installed: apt install -y coreutils" >&2; exit 1; }
|
|
|
|
echo "[deploy] state dir"
|
|
install -d -m 700 /var/lib/secrets-issuance
|
|
install -d -m 700 /var/lib/secrets-issuance/keys
|
|
|
|
echo "[deploy] admin token dir"
|
|
install -d -m 700 /etc/secrets-issuance
|
|
if [ ! -s /etc/secrets-issuance/admin-token ]; then
|
|
head -c 32 /dev/urandom | base64 > /etc/secrets-issuance/admin-token
|
|
chmod 600 /etc/secrets-issuance/admin-token
|
|
echo "[deploy] generated admin token at /etc/secrets-issuance/admin-token"
|
|
fi
|
|
|
|
echo "[deploy] install systemd units"
|
|
install -m 644 secrets-issuance/server.service \
|
|
/etc/systemd/system/secrets-issuance.service
|
|
install -m 644 secrets-issuance/deploy/webhook/secrets-issuance-deploy.service \
|
|
/etc/systemd/system/secrets-issuance-deploy.service
|
|
install -m 755 secrets-issuance/backup.sh /usr/local/bin/secrets-issuance-backup
|
|
install -m 644 secrets-issuance/backup.service \
|
|
/etc/systemd/system/secrets-issuance-backup.service
|
|
install -m 644 secrets-issuance/backup.timer \
|
|
/etc/systemd/system/secrets-issuance-backup.timer
|
|
|
|
if [ ! -d /opt/homelab-context/.git ]; then
|
|
echo " /opt/homelab-context is not a git clone — run bootstrap.sh first." >&2
|
|
exit 1
|
|
fi
|
|
|
|
systemctl daemon-reload
|
|
if systemctl is-active --quiet secrets-issuance.service; then
|
|
systemctl restart secrets-issuance.service
|
|
fi
|
|
if systemctl is-active --quiet secrets-issuance-deploy.service; then
|
|
systemctl restart secrets-issuance-deploy.service
|
|
fi
|
|
|
|
echo "[deploy] daemon-reload + enable backup timer"
|
|
systemctl daemon-reload
|
|
systemctl enable --now secrets-issuance-backup.timer
|
|
|
|
echo "[deploy] done"
|
|
echo "First-time enable:"
|
|
echo " systemctl enable --now secrets-issuance.service secrets-issuance-deploy.service"
|
|
echo "Webhook first-time setup:"
|
|
echo " $REPO_DIR/secrets-issuance/deploy/webhook/install.sh"
|