Sam Rolfe
4d87124840
- Add scripts/provision-hub-tokens.sh. It adds the five HUB_TOKEN_* keys to ~/.config/environment.d/10-secrets.conf. It is idempotent, keeps mode 600, leaves a mode-600 backup, and never prints a value. It uses openssl when present and /dev/urandom otherwise (this host has no openssl). - docker-compose.yml: run the container as the host user. The image's distroless nonroot user cannot read the 0600 secrets file. With nonroot the Hub read no tokens and every /ask returned 401. - Document the deploy steps, the finding, and the dry-run evidence in docs/outline/04-agent-runbook.md, docs/outline/02-config-and-env.md, README.md. Dry run on port 18788 with a scratch secrets file: /health ok with omniroute ok, control action refused, bad token 401. The host secrets file and the running hub container were not touched. Co-Authored-By: Paperclip <noreply@paperclip.ing>
103 lines
3.0 KiB
Bash
Executable File
103 lines
3.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# provision-hub-tokens.sh - add one Hub client token per door to the secrets
|
|
# file.
|
|
#
|
|
# The Hub accepts one bearer token per client, not per person
|
|
# (docs/hub-api.md section 3). This script adds the five HUB_TOKEN_* keys to
|
|
# ~/.config/environment.d/10-secrets.conf.
|
|
#
|
|
# It is idempotent. It adds only the keys that are missing. It never prints a
|
|
# token value and never overwrites an existing token.
|
|
#
|
|
# This changes host credentials. It needs Sam's OK before it runs
|
|
# (AGENTS.md "ask first: credentials").
|
|
#
|
|
# Usage:
|
|
# scripts/provision-hub-tokens.sh --check # report present/missing, change nothing
|
|
# scripts/provision-hub-tokens.sh --dry-run # same as --check, no change
|
|
# scripts/provision-hub-tokens.sh # add the missing keys
|
|
#
|
|
# Exit codes:
|
|
# 0 done (or all keys already present)
|
|
# 1 the secrets file is missing or is not usable
|
|
# 2 bad usage
|
|
#
|
|
set -euo pipefail
|
|
|
|
readonly SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
|
|
readonly PROJECT_DIR="$(cd -- "$SCRIPT_DIR/.." && pwd)"
|
|
readonly SECRETS_FILE="${HUB_SECRETS_FILE:-$HOME/.config/environment.d/10-secrets.conf}"
|
|
|
|
# The five doors from docs/hub-api.md section 3.
|
|
readonly TOKEN_KEYS=(HUB_TOKEN_PHONE HUB_TOKEN_ESP32 HUB_TOKEN_DSH HUB_TOKEN_CONSOLE HUB_TOKEN_ADMIN)
|
|
|
|
mode="apply"
|
|
case "${1:-}" in
|
|
--check|--dry-run) mode="check" ;;
|
|
"") ;;
|
|
*) echo "usage: $(basename "$0") [--check|--dry-run]" >&2; exit 2 ;;
|
|
esac
|
|
|
|
# gen_hex32 prints 64 hex characters (32 random bytes). It uses openssl when
|
|
# it is installed, and /dev/urandom otherwise. This host has no openssl.
|
|
gen_hex32() {
|
|
if command -v openssl >/dev/null 2>&1; then
|
|
openssl rand -hex 32
|
|
return
|
|
fi
|
|
od -An -N32 -tx1 /dev/urandom | tr -d ' \n'
|
|
}
|
|
|
|
if [[ ! -f "$SECRETS_FILE" ]]; then
|
|
echo "error: secrets file not found: $SECRETS_FILE" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# has_key reports whether KEY is already set in the file.
|
|
has_key() {
|
|
local key="$1"
|
|
grep -qE "^[[:space:]]*${key}=" "$SECRETS_FILE"
|
|
}
|
|
|
|
missing=()
|
|
for key in "${TOKEN_KEYS[@]}"; do
|
|
if has_key "$key"; then
|
|
echo "present: $key"
|
|
else
|
|
echo "missing: $key"
|
|
missing+=("$key")
|
|
fi
|
|
done
|
|
|
|
if [[ ${#missing[@]} -eq 0 ]]; then
|
|
echo "done: all ${#TOKEN_KEYS[@]} Hub tokens are present. No change."
|
|
exit 0
|
|
fi
|
|
|
|
if [[ "$mode" == "check" ]]; then
|
|
echo "check only: ${#missing[@]} token(s) would be added. No change."
|
|
exit 0
|
|
fi
|
|
|
|
# Back up first. The backup keeps the same restrictive mode.
|
|
backup="${SECRETS_FILE}.bak.$(date -u +%Y%m%dT%H%M%SZ)"
|
|
cp -p "$SECRETS_FILE" "$backup"
|
|
chmod 600 "$backup"
|
|
echo "backup: $backup"
|
|
|
|
# Add the missing keys. openssl writes the value; nothing prints it.
|
|
{
|
|
echo ""
|
|
echo "# Hub client tokens (one per door, docs/hub-api.md section 3)."
|
|
echo "# Added by scripts/provision-hub-tokens.sh on $(date -u +%Y-%m-%dT%H:%M:%SZ)."
|
|
for key in "${missing[@]}"; do
|
|
value="$(gen_hex32)"
|
|
printf '%s="%s"\n' "$key" "$value"
|
|
done
|
|
} >> "$SECRETS_FILE"
|
|
|
|
chmod 600 "$SECRETS_FILE"
|
|
|
|
echo "done: added ${#missing[@]} key(s) to $SECRETS_FILE (values not shown)."
|