fix: pass vector rotation operator env

scripts/vector-rotate-bootstrap-password.sh

@@ -4,9 +4,49 @@ set -eu
 cd "$(dirname "$0")/.."
 . ./deploy/vector/secret-policy.sh
 
-if [ "$#" -ne 2 ]; then
-  echo "usage: $0 OLD_SECRET_FILE NEW_SECRET_FILE" >&2
+usage() {
+  echo "usage: $0 [--env-file OPERATOR_ENV] OLD_SECRET_FILE NEW_SECRET_FILE" >&2
+  echo "set THT_VECTOR_OPERATOR_ENV_FILE instead of --env-file when required by automation" >&2
   exit 2
+}
+
+operator_env=${THT_VECTOR_OPERATOR_ENV_FILE:-}
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --env-file)
+      [ "$#" -ge 2 ] || usage
+      operator_env=$2
+      shift 2
+      ;;
+    --env-file=*)
+      operator_env=${1#--env-file=}
+      shift
+      ;;
+    --) shift; break ;;
+    -*) usage ;;
+    *) break ;;
+  esac
+done
+
+if [ -z "$operator_env" ]; then
+  echo "rotation requires --env-file or THT_VECTOR_OPERATOR_ENV_FILE; there is no implicit default" >&2
+  exit 2
+fi
+if [ -L "$operator_env" ] || [ ! -f "$operator_env" ] || [ ! -r "$operator_env" ]; then
+  echo "operator env must be a readable regular file, not a symlink: $operator_env" >&2
+  exit 2
+fi
+operator_env_mode=$(stat -c '%a' "$operator_env" 2>/dev/null || stat -f '%Lp' "$operator_env" 2>/dev/null) || {
+  echo "cannot inspect operator env permissions: $operator_env" >&2
+  exit 2
+}
+if [ $((0$operator_env_mode & 022)) -ne 0 ]; then
+  echo "operator env must not be writable by group or other users: $operator_env" >&2
+  exit 2
+fi
+
+if [ "$#" -ne 2 ]; then
+  usage
 fi
 
 absolute_file() {
@@ -14,6 +54,8 @@ absolute_file() {
   printf '%s/%s\n' "$directory" "$(basename -- "$1")"
 }
 
+operator_env=$(absolute_file "$operator_env")
+
 old_secret=$(absolute_file "$1")
 new_secret=$(absolute_file "$2")
 validate_secret_file "$old_secret" old_bootstrap_secret
@@ -29,7 +71,7 @@ trap 'rm -f "$replacement"' EXIT HUP INT TERM
 cp "$new_secret" "$replacement"
 chmod 0600 "$replacement"
 
-docker compose --env-file deploy/env/local.env -f compose.yaml -f deploy/compose.local-vector.yaml \
+docker compose --env-file "$operator_env" -f compose.yaml -f deploy/compose.local-vector.yaml \
   --project-name "$project" --profile local-vector run --rm --no-deps \
   --user 0:0 \
   --entrypoint /opt/venv/bin/python \
@@ -43,4 +85,5 @@ mv -f "$replacement" "$old_secret"
 trap - EXIT HUP INT TERM
 
 echo "Deployment bootstrap secret atomically replaced only after verified database login."
-echo "Re-run: docker compose --env-file deploy/env/local.env -f compose.yaml -f deploy/compose.local-vector.yaml --project-name $project --profile local-vector up --wait vector-reconcile vector-migrate core"
+echo "Re-run with the same operator env file: $operator_env"
+echo "docker compose --env-file OPERATOR_ENV -f compose.yaml -f deploy/compose.local-vector.yaml --project-name $project --profile local-vector up --wait vector-reconcile vector-migrate core"