Sam Rolfe
de9b06a3d1
- mqtt_audio_bridge.py: MQTT_USER / MQTT_PASS are read from the environment, falling back to ~/.config/environment.d/10-secrets.conf (mode 600). The environment.d trap means a fresh SSH shell needs the file fallback. - docker-compose.yml: pass MQTT_USER / MQTT_PASS through; keeps the live network_mode / Dockerfile topology. - start_bridge.sh: launcher that sources the secrets file before compose up. - app.py: commits the live initial_prompt that was uncommitted. - .gitignore: add venv/ (was missing), __pycache__, *.bak*, *.wav. - git rm -r --cached venv/: 13,413 tracked venv files removed from the index. Credential note: MQTT_PASS was hardcoded in edaf914. origin/main was later force-rewritten to redact it, but the value was exposed and must still be rotated. Removing venv/ from the index does not shrink the repository: the objects stay in history until a history rewrite and GC. Co-Authored-By: Paperclip <noreply@paperclip.ing>
54 lines
1.6 KiB
Bash
Executable File
54 lines
1.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# start_bridge.sh — (re)start voice_bridge with MQTT credentials from the
|
|
# environment, not from source.
|
|
#
|
|
# environment.d does NOT reach a fresh SSH shell (AGENTS.md section 4.4), so
|
|
# this script sources the mode-600 secrets file itself. Only MQTT_USER and
|
|
# MQTT_PASS are passed to the container; no secret values are written to git.
|
|
#
|
|
# Usage:
|
|
# ./start_bridge.sh # rebuild if needed and (re)create voice_bridge
|
|
# ./start_bridge.sh --status # show container state and recent logs
|
|
# ./start_bridge.sh --logs # follow the bridge log
|
|
#
|
|
# Rollback: the previous image is kept as voice_bridge:pre-credential-hygiene.
|
|
|
|
set -euo pipefail
|
|
|
|
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
SECRETS="${SECRETS_FILE:-$HOME/.config/environment.d/10-secrets.conf}"
|
|
|
|
load_secrets() {
|
|
if [ -f "$SECRETS" ]; then
|
|
# shellcheck disable=SC1090
|
|
set -a; . "$SECRETS"; set +a
|
|
else
|
|
echo "start_bridge.sh: $SECRETS not found" >&2
|
|
exit 1
|
|
fi
|
|
if [ -z "${MQTT_USER:-}" ] || [ -z "${MQTT_PASS:-}" ]; then
|
|
echo "start_bridge.sh: MQTT_USER / MQTT_PASS missing from $SECRETS" >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
case "${1:-}" in
|
|
--status)
|
|
docker ps --filter name=voice_bridge --format '{{.Names}}\t{{.Image}}\t{{.Status}}'
|
|
docker logs --tail 20 voice_bridge 2>&1 || true
|
|
exit 0
|
|
;;
|
|
--logs)
|
|
exec docker logs -f voice_bridge
|
|
;;
|
|
"")
|
|
load_secrets
|
|
exec docker compose -f "$HERE/docker-compose.yml" up -d --build voice-bridge
|
|
;;
|
|
*)
|
|
echo "start_bridge.sh: unknown option $1" >&2
|
|
exit 2
|
|
;;
|
|
esac
|