75 lines
2.3 KiB
Bash
Executable File
75 lines
2.3 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
ROOT=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)
|
|
ENV_FILE="$ROOT/.env"
|
|
TEST_IMAGE="${TEST_IMAGE:-who-need-help:test}"
|
|
|
|
if [ ! -f "$ENV_FILE" ]; then
|
|
echo "Missing $ENV_FILE. Copy .env.example to .env first." >&2
|
|
exit 1
|
|
fi
|
|
|
|
for command in docker openssl perl; do
|
|
if ! command -v "$command" >/dev/null 2>&1; then
|
|
echo "Required command is unavailable: $command" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
set -a
|
|
# shellcheck source=/dev/null
|
|
. "$ENV_FILE"
|
|
set +a
|
|
|
|
: "${POSTGRES_USER:?POSTGRES_USER is missing from .env}"
|
|
: "${POSTGRES_DB:?POSTGRES_DB is missing from .env}"
|
|
|
|
case "$POSTGRES_USER" in
|
|
*[!A-Za-z0-9_]* | "") echo "POSTGRES_USER contains unsupported characters." >&2; exit 1 ;;
|
|
esac
|
|
|
|
case "$POSTGRES_DB" in
|
|
*[!A-Za-z0-9_]* | "") echo "POSTGRES_DB contains unsupported characters." >&2; exit 1 ;;
|
|
esac
|
|
|
|
generate_phoenix_secret() {
|
|
docker run --rm "$TEST_IMAGE" mix phx.gen.secret
|
|
}
|
|
|
|
new_secret_key_base=$(generate_phoenix_secret)
|
|
new_handover_secret=$(generate_phoenix_secret)
|
|
new_release_cookie=$(generate_phoenix_secret)
|
|
new_postgres_password=$(openssl rand -hex 32)
|
|
new_database_url="ecto://${POSTGRES_USER}:${new_postgres_password}@db/${POSTGRES_DB}"
|
|
|
|
tmp_env=$(mktemp "${ENV_FILE}.rotate.XXXXXX")
|
|
trap 'rm -f "$tmp_env"' EXIT HUP INT TERM
|
|
chmod 600 "$tmp_env"
|
|
|
|
NEW_SECRET_KEY_BASE=$new_secret_key_base \
|
|
NEW_HANDOVER_SECRET=$new_handover_secret \
|
|
NEW_RELEASE_COOKIE=$new_release_cookie \
|
|
NEW_POSTGRES_PASSWORD=$new_postgres_password \
|
|
NEW_DATABASE_URL=$new_database_url \
|
|
perl -pe '
|
|
s/^SECRET_KEY_BASE=.*/SECRET_KEY_BASE=$ENV{NEW_SECRET_KEY_BASE}/;
|
|
s/^HANDOVER_SECRET=.*/HANDOVER_SECRET=$ENV{NEW_HANDOVER_SECRET}/;
|
|
s/^RELEASE_COOKIE=.*/RELEASE_COOKIE=$ENV{NEW_RELEASE_COOKIE}/;
|
|
s/^POSTGRES_PASSWORD=.*/POSTGRES_PASSWORD=$ENV{NEW_POSTGRES_PASSWORD}/;
|
|
s/^DATABASE_URL=.*/DATABASE_URL=$ENV{NEW_DATABASE_URL}/;
|
|
' "$ENV_FILE" >"$tmp_env"
|
|
|
|
printf "ALTER ROLE \"%s\" WITH PASSWORD '%s';\n" \
|
|
"$POSTGRES_USER" "$new_postgres_password" |
|
|
docker compose --project-directory "$ROOT" exec -T db \
|
|
psql --set ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
|
|
>/dev/null
|
|
|
|
mv "$tmp_env" "$ENV_FILE"
|
|
chmod 600 "$ENV_FILE"
|
|
trap - EXIT HUP INT TERM
|
|
|
|
echo "Local application and PostgreSQL secrets rotated without printing their values."
|
|
echo "Run docker compose up -d --wait to apply the new application environment."
|