ocelot-Social-Community/Ocelot-Social
1
0
Fork 0
mirror of https://github.com/Ocelot-Social-Community/Ocelot-Social.git synced 2025-12-12 23:35:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

secrets scripts

Browse Source
This commit is contained in:
Ulf Gebhardt 2023-03-13 13:08:22 +01:00
parent 1a82a32b2e
commit c06b6c82ee
Signed by: ulfgebhardt
GPG Key ID: DA6B843E748679C9
3 changed files with 99 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
deployment/scripts/secret.generate.sh Executable file
View File

@ -0,0 +1,14 @@
#!/bin/bash
# generate a secret and store it in the SECRET file.
# Note that this overwrites the existing file
# base setup
SCRIPT_PATH=$(realpath $0)
SCRIPT_DIR=$(dirname $SCRIPT_PATH)
# configuration
CONFIGURATION=${CONFIGURATION:-"example"}
SECRET_FILE=${SCRIPT_DIR}/../configurations/${CONFIGURATION}/SECRET
openssl rand -base64 32 > ${SECRET_FILE}

44
deployment/scripts/secrets.decrypt.sh Executable file
View File

@ -0,0 +1,44 @@
#!/bin/bash
# decrypt secrets in the selected configuration
# Note that existing decrypted files will be overwritten
# base setup
SCRIPT_PATH=$(realpath $0)
SCRIPT_DIR=$(dirname $SCRIPT_PATH)
# configuration
CONFIGURATION=${CONFIGURATION:-"example"}
SECRET=${SECRET}
SECRET_FILE=${SCRIPT_DIR}/../configurations/${CONFIGURATION}/SECRET
FILES=(\
"${SCRIPT_DIR}/../configurations/${CONFIGURATION}/.env" \
"${SCRIPT_DIR}/../configurations/${CONFIGURATION}/kubeconfig.yaml" \
"${SCRIPT_DIR}/../configurations/${CONFIGURATION}/kubernetes/values.yaml" \
"${SCRIPT_DIR}/../configurations/${CONFIGURATION}/kubernetes/dns.values.yaml" \
)
# Load SECRET from file if it is not set explicitly
if [ -z ${SECRET} ] && [ -f "${SECRET_FILE}" ]; then
SECRET=$(<${SECRET_FILE})
fi
# exit when there is no SECRET set
if [ -z ${SECRET} ]; then
echo "No SECRET provided and no SECRET-File found."
exit 1
fi
# decrypt
for file in "${FILES[@]}"
do
if [ -f "${file}.enc" ]; then
#gpg --symmetric --batch --passphrase="${SECRET}" --cipher-algo AES256 --output ${file}.enc ${file}
gpg --quiet --batch --yes --decrypt --passphrase="${SECRET}" --output ${file} ${file}.enc
echo "Decrypted ${file}"
fi
done
echo "DONE"
# gpg --quiet --batch --yes --decrypt --passphrase="${SECRET}" \
# --output $HOME/secrets/my_secret.json my_secret.json.gpg

41
deployment/scripts/secrets.encrypt.sh Executable file
View File

@ -0,0 +1,41 @@
#!/bin/bash
# encrypt secrets in the selected configuration
# Note that existing encrypted files will be overwritten
# base setup
SCRIPT_PATH=$(realpath $0)
SCRIPT_DIR=$(dirname $SCRIPT_PATH)
# configuration
CONFIGURATION=${CONFIGURATION:-"example"}
SECRET=${SECRET}
SECRET_FILE=${SCRIPT_DIR}/../configurations/${CONFIGURATION}/SECRET
FILES=(\
"${SCRIPT_DIR}/../configurations/${CONFIGURATION}/.env" \
"${SCRIPT_DIR}/../configurations/${CONFIGURATION}/kubeconfig.yaml" \
"${SCRIPT_DIR}/../configurations/${CONFIGURATION}/kubernetes/values.yaml" \
"${SCRIPT_DIR}/../configurations/${CONFIGURATION}/kubernetes/dns.values.yaml" \
)
# Load SECRET from file if it is not set explicitly
if [ -z ${SECRET} ] && [ -f "${SECRET_FILE}" ]; then
SECRET=$(<${SECRET_FILE})
fi
# exit when there is no SECRET set
if [ -z ${SECRET} ]; then
echo "No SECRET provided and no SECRET-File found."
exit 1
fi
# encrypt
for file in "${FILES[@]}"
do
if [ -f "${file}" ]; then
gpg --symmetric --batch --yes --passphrase="${SECRET}" --cipher-algo AES256 --output ${file}.enc ${file}
echo "Encrypted ${file}"
fi
done
echo "DONE"