fix(deploy): generalize connector secret overrides

2026-08-04 15:21:49 +02:00
parent b5071f1494
commit eb01979072
9 changed files with 384 additions and 91 deletions
@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+# Generate one untracked, installation-specific Compose override from explicit THT_WS_* bindings.
+set -euo pipefail
+
+usage() {
+  echo "usage: $0 --bindings-env <workspace-bindings.env> --operator-env <operator.env> --output <override.yaml>" >&2
+  exit 2
+}
+
+trim() {
+  local value="$1"
+  value="${value#"${value%%[![:space:]]*}"}"
+  value="${value%"${value##*[![:space:]]}"}"
+  printf '%s' "$value"
+}
+
+is_safe_absolute_path() {
+  local value="$1" segment
+  local -a segments
+  [[ "$value" == /* && "$value" != *//* ]] || return 1
+  IFS=/ read -r -a segments <<<"$value"
+  for segment in "${segments[@]}"; do
+    [[ "$segment" != . && "$segment" != .. ]] || return 1
+  done
+}
+
+read_env_value() {
+  local source="$1" wanted="$2" line trimmed name value result=""
+  while IFS= read -r line || [[ -n "$line" ]]; do
+    trimmed="$(trim "$line")"
+    [[ -n "$trimmed" && "$trimmed" != \#* && "$trimmed" == *=* ]] || continue
+    name="$(trim "${trimmed%%=*}")"
+    [[ "$name" == "$wanted" ]] || continue
+    value="$(trim "${trimmed#*=}")"
+    value="$(trim "${value%%#*}")"
+    value="${value#\"}"; value="${value%\"}"
+    value="${value#\'}"; value="${value%\'}"
+    result="$value"
+  done <"$source"
+  printf '%s' "$result"
+}
+
+bindings_env=""
+operator_env=""
+output=""
+while (($#)); do
+  case "$1" in
+    --bindings-env) bindings_env="${2:-}"; shift 2 ;;
+    --operator-env) operator_env="${2:-}"; shift 2 ;;
+    --output) output="${2:-}"; shift 2 ;;
+    *) usage ;;
+  esac
+done
+
+[[ -f "$bindings_env" && -f "$operator_env" && -n "$output" ]] || usage
+[[ ! -e "$output" ]] || { echo "refusing to overwrite connector override: $output" >&2; exit 2; }
+
+names=()
+targets=()
+sources=()
+while IFS=$'\t' read -r name target; do
+  [[ "$name" =~ ^THT_WS_[A-Za-z0-9_]+_FILE$ ]] || continue
+  [[ "$target" =~ ^/run/secrets/[A-Za-z0-9][A-Za-z0-9_.-]*$ && "$target" != *..* ]] || {
+    echo "invalid connector secret target for $name: $target" >&2
+    exit 2
+  }
+  source_name="${name%_FILE}_SOURCE"
+  source_path="$(read_env_value "$operator_env" "$source_name")"
+  if [[ -v "$source_name" ]]; then
+    source_path="${!source_name}"
+  fi
+  if [[ -z "$source_path" ]]; then
+    echo "set $source_name in $operator_env" >&2
+    exit 2
+  fi
+  if ! is_safe_absolute_path "$source_path"; then
+    echo "unsafe source path for $source_name in $operator_env" >&2
+    exit 2
+  fi
+  names+=("$name")
+  targets+=("${target#/run/secrets/}")
+  sources+=("$source_name")
+done < <(
+  awk '
+    function trim(value) { sub(/^[[:space:]]+/, "", value); sub(/[[:space:]]+$/, "", value); return value }
+    {
+      line = trim($0)
+      if (line == "" || line ~ /^#/) next
+      equals = index(line, "=")
+      if (!equals) next
+      name = trim(substr(line, 1, equals - 1))
+      value = trim(substr(line, equals + 1))
+      sub(/[[:space:]]+#.*/, "", value)
+      if (value ~ /^".*"$/ || value ~ /^\047.*\047$/) value = substr(value, 2, length(value) - 2)
+      print name "\t" value
+    }
+  ' "$bindings_env"
+)
+
+((${#names[@]})) || { echo "no THT_WS_*_FILE connector bindings found in $bindings_env" >&2; exit 2; }
+
+{
+  printf '%s\n' '# Generated by scripts/generate-connector-secrets-override.sh; keep this file untracked.'
+  printf '%s\n' 'services:' '  core:' '    secrets:'
+  for ((index = 0; index < ${#names[@]}; index += 1)); do
+    printf '      - source: connector_secret_%d\n' "$((index + 1))"
+    printf '        target: %s\n' "${targets[index]}"
+  done
+  printf '%s\n' '' 'secrets:'
+  for ((index = 0; index < ${#names[@]}; index += 1)); do
+    printf '  connector_secret_%d:\n' "$((index + 1))"
+    printf '    file: ${%s:?set %s}\n' "${sources[index]}" "${sources[index]}"
+  done
+} >"$output"
+
+printf 'generated %s connector secret mount(s) at %s\n' "${#names[@]}" "$output"