47 lines
1.6 KiB
Bash
Executable File
47 lines
1.6 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
cd "$(dirname "$0")/.."
|
|
. ./deploy/vector/secret-policy.sh
|
|
|
|
if [ "$#" -ne 2 ]; then
|
|
echo "usage: $0 OLD_SECRET_FILE NEW_SECRET_FILE" >&2
|
|
exit 2
|
|
fi
|
|
|
|
absolute_file() {
|
|
directory=$(CDPATH= cd -- "$(dirname -- "$1")" && pwd)
|
|
printf '%s/%s\n' "$directory" "$(basename -- "$1")"
|
|
}
|
|
|
|
old_secret=$(absolute_file "$1")
|
|
new_secret=$(absolute_file "$2")
|
|
validate_secret_file "$old_secret" old_bootstrap_secret
|
|
validate_secret_file "$new_secret" new_bootstrap_secret
|
|
if [ "$old_secret" -ef "$new_secret" ]; then
|
|
echo "old and new secret files must be distinct" >&2
|
|
exit 2
|
|
fi
|
|
|
|
project=${COMPOSE_PROJECT_NAME:-thothii}
|
|
replacement=$(mktemp "${old_secret}.rotate.XXXXXX")
|
|
trap 'rm -f "$replacement"' EXIT HUP INT TERM
|
|
cp "$new_secret" "$replacement"
|
|
chmod 0600 "$replacement"
|
|
|
|
docker compose -f compose.yaml -f deploy/compose.local-vector.yaml \
|
|
--project-name "$project" --profile local-vector run --rm --no-deps \
|
|
--user 0:0 \
|
|
--entrypoint /opt/venv/bin/python \
|
|
--volume "$old_secret:/run/secrets/bootstrap-old:ro" \
|
|
--volume "$new_secret:/run/secrets/bootstrap-new:ro" \
|
|
--volume "$(pwd)/deploy/vector/rotate-bootstrap-password.py:/opt/thoth/rotate-bootstrap-password.py:ro" \
|
|
core /opt/thoth/rotate-bootstrap-password.py \
|
|
/run/secrets/bootstrap-old /run/secrets/bootstrap-new
|
|
|
|
mv -f "$replacement" "$old_secret"
|
|
trap - EXIT HUP INT TERM
|
|
|
|
echo "Deployment bootstrap secret atomically replaced only after verified database login."
|
|
echo "Re-run: docker compose -f compose.yaml -f deploy/compose.local-vector.yaml --project-name $project --profile local-vector up --wait vector-reconcile vector-migrate core"
|