46 lines
2.1 KiB
Bash
46 lines
2.1 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# This is the only production writer for the dedicated control-plane machine
|
|
# credential volume. It never receives, prints, or exports a secret value.
|
|
BASE_DIR="${BASE_DIR:-/home/m/assistant-deploy}"
|
|
REPO_DIR="${REPO_DIR:-$BASE_DIR/repo}"
|
|
ENV_FILE="${ENV_FILE:-$BASE_DIR/production-compose.env}"
|
|
COMPOSE_FILE="$REPO_DIR/deploy/docker-compose.prod.yml"
|
|
VOLUME="assistant_control_plane_service_secrets"
|
|
ACTION="${1:-ensure}"
|
|
CREDENTIAL="${MACHINE_CREDENTIAL:-control-plane}"
|
|
SECRET_ROOT="/run/control-plane-secrets"
|
|
VOLUME="assistant_control_plane_service_secrets"
|
|
if [[ "$CREDENTIAL" == "acceptance-harness" ]]; then
|
|
SECRET_ROOT="/run/core-secrets"
|
|
VOLUME="assistant_core_secrets"
|
|
fi
|
|
|
|
case "$ACTION" in
|
|
ensure|rotate) ;;
|
|
*) echo "unsupported machine credential action" >&2; exit 2 ;;
|
|
esac
|
|
|
|
[[ -f "$ENV_FILE" ]] || { echo "production compose environment is missing" >&2; exit 1; }
|
|
[[ -f "$COMPOSE_FILE" ]] || { echo "production compose file is missing" >&2; exit 1; }
|
|
|
|
compose() { docker compose --env-file "$ENV_FILE" -f "$COMPOSE_FILE" "$@"; }
|
|
|
|
# `docker volume create` is idempotent and does not inspect or expose content.
|
|
docker volume create "$VOLUME" >/dev/null
|
|
revision="$(git -C "$REPO_DIR" rev-parse HEAD)"
|
|
ASSISTANT_SOURCE_REVISION="$revision" compose build --build-arg "SOURCE_REVISION=$revision" secret-control-plane >/dev/null
|
|
|
|
if [[ "$ACTION" == "rotate" ]]; then
|
|
# Only bounded, non-secret rotation reasons can reach the audit trail.
|
|
reason="${ROTATION_REASON:-owner-requested-rotation}"
|
|
case "$reason" in
|
|
owner-requested-rotation|exposure-detected) ;;
|
|
*) echo "invalid rotation reason" >&2; exit 2 ;;
|
|
esac
|
|
ASSISTANT_SOURCE_REVISION="$revision" compose --profile secret-control-plane run --rm --no-deps -e "SECRET_CONTROL_PLANE_ROOT=$SECRET_ROOT" secret-control-plane -credential "$CREDENTIAL" -reason "$reason" rotate
|
|
else
|
|
ASSISTANT_SOURCE_REVISION="$revision" compose --profile secret-control-plane run --rm --no-deps -e "SECRET_CONTROL_PLANE_ROOT=$SECRET_ROOT" secret-control-plane -credential "$CREDENTIAL" ensure
|
|
fi
|