132 lines
4.4 KiB
Bash
Executable File
132 lines
4.4 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
ROOT=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)
|
|
TEMPLATE="$ROOT/.env.load.example"
|
|
ENV_FILE="$ROOT/.env.load"
|
|
|
|
for command in openssl perl; do
|
|
if ! command -v "$command" >/dev/null 2>&1; then
|
|
echo "Required command is unavailable: $command" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
if [ -f "$ENV_FILE" ]; then
|
|
chmod 600 "$ENV_FILE"
|
|
|
|
needs_fixture_password=true
|
|
needs_resilience_timeout=true
|
|
needs_resilience_interval=true
|
|
needs_resilience_request_timeout=true
|
|
needs_traefik_retry_attempts=true
|
|
|
|
grep -q '^LOAD_FIXTURE_PASSWORD=' "$ENV_FILE" && needs_fixture_password=false
|
|
grep -q '^LOAD_RESILIENCE_RECOVERY_TIMEOUT_SECONDS=' "$ENV_FILE" &&
|
|
needs_resilience_timeout=false
|
|
grep -q '^LOAD_RESILIENCE_PROBE_INTERVAL_SECONDS=' "$ENV_FILE" &&
|
|
needs_resilience_interval=false
|
|
grep -q '^LOAD_RESILIENCE_REQUEST_TIMEOUT_SECONDS=' "$ENV_FILE" &&
|
|
needs_resilience_request_timeout=false
|
|
grep -q '^TRAEFIK_RETRY_ATTEMPTS=' "$ENV_FILE" && needs_traefik_retry_attempts=false
|
|
|
|
if [ "$needs_fixture_password" = false ] &&
|
|
[ "$needs_resilience_timeout" = false ] &&
|
|
[ "$needs_resilience_interval" = false ] &&
|
|
[ "$needs_resilience_request_timeout" = false ] &&
|
|
[ "$needs_traefik_retry_attempts" = false ]; then
|
|
echo ".env.load already exists; no secret or experiment input was changed."
|
|
exit 0
|
|
fi
|
|
|
|
umask 077
|
|
load_fixture_password=
|
|
|
|
if [ "$needs_fixture_password" = true ]; then
|
|
load_fixture_password=$(openssl rand -hex 24)
|
|
fi
|
|
|
|
{
|
|
if [ "$needs_fixture_password" = true ]; then
|
|
printf '\n# Added by the authenticated-load profile upgrade.\n'
|
|
printf 'LOAD_AUTH_VUS=8\n'
|
|
printf 'LOAD_AUTH_WS_TIMEOUT_MS=5000\n'
|
|
printf 'LOAD_AUTH_THINK_SECONDS=0.1\n'
|
|
printf 'LOAD_FIXTURE_PASSWORD=%s\n' "$load_fixture_password"
|
|
fi
|
|
|
|
if [ "$needs_resilience_timeout" = true ] ||
|
|
[ "$needs_resilience_interval" = true ]; then
|
|
printf '\n# Added by the local resilience-profile upgrade.\n'
|
|
fi
|
|
|
|
if [ "$needs_resilience_timeout" = true ]; then
|
|
printf 'LOAD_RESILIENCE_RECOVERY_TIMEOUT_SECONDS=120\n'
|
|
fi
|
|
|
|
if [ "$needs_resilience_interval" = true ]; then
|
|
printf 'LOAD_RESILIENCE_PROBE_INTERVAL_SECONDS=0.05\n'
|
|
fi
|
|
|
|
if [ "$needs_resilience_request_timeout" = true ]; then
|
|
printf 'LOAD_RESILIENCE_REQUEST_TIMEOUT_SECONDS=2\n'
|
|
fi
|
|
|
|
if [ "$needs_traefik_retry_attempts" = true ]; then
|
|
printf 'TRAEFIK_RETRY_ATTEMPTS=3\n'
|
|
fi
|
|
} >>"$ENV_FILE"
|
|
chmod 600 "$ENV_FILE"
|
|
unset load_fixture_password needs_fixture_password needs_resilience_timeout \
|
|
needs_resilience_interval needs_resilience_request_timeout \
|
|
needs_traefik_retry_attempts
|
|
echo "Added missing authenticated-load/resilience inputs to ignored .env.load."
|
|
exit 0
|
|
fi
|
|
|
|
if [ ! -f "$TEMPLATE" ]; then
|
|
echo "Missing tracked template: $TEMPLATE" >&2
|
|
exit 1
|
|
fi
|
|
|
|
umask 077
|
|
postgres_password=$(openssl rand -hex 32)
|
|
secret_key_base=$(openssl rand -hex 64)
|
|
handover_secret=$(openssl rand -hex 64)
|
|
release_cookie=$(openssl rand -hex 64)
|
|
metrics_token=$(openssl rand -hex 32)
|
|
load_fixture_password=$(openssl rand -hex 24)
|
|
database_url="ecto://wnh_load:${postgres_password}@db/who_need_help_load"
|
|
temporary=$(mktemp "${ENV_FILE}.XXXXXX")
|
|
trap 'rm -f "$temporary"' EXIT HUP INT TERM
|
|
|
|
POSTGRES_PASSWORD_VALUE=$postgres_password \
|
|
DATABASE_URL_VALUE=$database_url \
|
|
SECRET_KEY_BASE_VALUE=$secret_key_base \
|
|
HANDOVER_SECRET_VALUE=$handover_secret \
|
|
RELEASE_COOKIE_VALUE=$release_cookie \
|
|
METRICS_TOKEN_VALUE=$metrics_token \
|
|
LOAD_FIXTURE_PASSWORD_VALUE=$load_fixture_password \
|
|
perl -0pe '
|
|
s/GENERATE_POSTGRES_PASSWORD/$ENV{POSTGRES_PASSWORD_VALUE}/g;
|
|
s/GENERATE_DATABASE_URL/$ENV{DATABASE_URL_VALUE}/g;
|
|
s/GENERATE_SECRET_KEY_BASE/$ENV{SECRET_KEY_BASE_VALUE}/g;
|
|
s/GENERATE_HANDOVER_SECRET/$ENV{HANDOVER_SECRET_VALUE}/g;
|
|
s/GENERATE_RELEASE_COOKIE/$ENV{RELEASE_COOKIE_VALUE}/g;
|
|
s/GENERATE_METRICS_TOKEN/$ENV{METRICS_TOKEN_VALUE}/g;
|
|
s/GENERATE_LOAD_FIXTURE_PASSWORD/$ENV{LOAD_FIXTURE_PASSWORD_VALUE}/g;
|
|
' "$TEMPLATE" >"$temporary"
|
|
|
|
if grep -Eq '^[A-Z0-9_]+=GENERATE_' "$temporary"; then
|
|
echo "A secret marker was not replaced; refusing to publish .env.load." >&2
|
|
exit 1
|
|
fi
|
|
|
|
chmod 600 "$temporary"
|
|
mv "$temporary" "$ENV_FILE"
|
|
trap - EXIT HUP INT TERM
|
|
unset postgres_password secret_key_base handover_secret release_cookie metrics_token \
|
|
load_fixture_password database_url
|
|
|
|
echo "Generated independent load-profile secrets in ignored .env.load."
|