feat: migrate secrets to Infisical

deploy/container-entrypoint.sh

@@ -1,13 +1,118 @@
 #!/bin/sh
 set -eu
 
-if [ "${1:-}" = "serve" ]; then
-	node scripts/db-migrate.mjs
-	exec node build
+project_id=${INFISICAL_PROJECT_ID:?INFISICAL_PROJECT_ID is required}
+environment=${INFISICAL_ENVIRONMENT:?INFISICAL_ENVIRONMENT is required}
+runtime_scope=${INFISICAL_RUNTIME_SCOPE:?INFISICAL_RUNTIME_SCOPE is required}
+client_id_file=${INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_FILE:?INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_FILE is required}
+client_secret_file=${INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET_FILE:?INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET_FILE is required}
+build_number=${SHD_BUILD_NUMBER:-0}
+commit_sha=${SHD_COMMIT_SHA:-}
+secret_file=
+shared_secret_file=
+
+cleanup() {
+	if [ -n "$secret_file" ]; then rm -f "$secret_file"; fi
+	if [ -n "$shared_secret_file" ]; then rm -f "$shared_secret_file"; fi
+}
+
+trap cleanup EXIT
+trap 'exit 129' HUP
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+if [ ! -r "$client_id_file" ] || [ ! -r "$client_secret_file" ]; then
+	echo "Infisical Universal Auth credential files are not readable." >&2
+	exit 1
 fi
 
-if [ "${1:-}" = "scheduler" ]; then
-	exec node scripts/scheduler-client.mjs
+if [ "$(id -u)" -eq 0 ]; then
+	runtime_uid=$(id -u shd-runtime)
+	for credential_file in "$client_id_file" "$client_secret_file"; do
+		credential_uid=$(stat -c '%u' "$credential_file")
+		credential_mode=$(stat -c '%a' "$credential_file")
+		if [ "$credential_uid" -eq "$runtime_uid" ] || [ $((credential_mode % 100)) -ne 0 ]; then
+			echo "Infisical credential files must not be readable by the application runtime user." >&2
+			exit 1
+		fi
+	done
+	if [ "$runtime_scope" = app ] && ! { [ "${1:-}" = node ] && [ "${2:-}" = scripts/validate-runtime-environment.mjs ]; }; then
+		chgrp -R node /app/data
+		chmod -R g+rwX /app/data
+	fi
 fi
 
-exec "$@"
+client_id=$(cat "$client_id_file")
+client_secret=$(cat "$client_secret_file")
+if [ -z "$client_id" ] || [ -z "$client_secret" ]; then
+	echo "Infisical Universal Auth credential files must not be empty." >&2
+	exit 1
+fi
+
+unset INFISICAL_TOKEN INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN TOKEN
+access_token=$(
+	INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="$client_id" \
+		INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="$client_secret" \
+		infisical login --method=universal-auth --silent --plain
+)
+unset client_id client_secret
+
+if [ -z "$access_token" ]; then
+	echo "Infisical Universal Auth returned an empty access token." >&2
+	exit 1
+fi
+
+umask 077
+secret_file=$(mktemp /tmp/shd-infisical-app.XXXXXX)
+
+case "$runtime_scope" in
+	app)
+		INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN="$access_token" infisical export \
+			--projectId="$project_id" \
+			--env="$environment" \
+			--path=/app \
+			--format=json \
+			--output-file="$secret_file" \
+			--silent
+		shared_secret_file=$(mktemp /tmp/shd-infisical-shared.XXXXXX)
+		INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN="$access_token" infisical export \
+			--projectId="$project_id" \
+			--env="$environment" \
+			--path=/shared/scheduler \
+			--format=json \
+			--output-file="$shared_secret_file" \
+			--silent
+		;;
+	scheduler)
+		INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN="$access_token" infisical export \
+			--projectId="$project_id" \
+			--env="$environment" \
+			--path=/shared/scheduler \
+			--format=json \
+			--output-file="$secret_file" \
+			--silent
+		;;
+	*)
+		echo "Unsupported INFISICAL_RUNTIME_SCOPE: $runtime_scope" >&2
+		exit 2
+		;;
+esac
+
+unset access_token \
+	INFISICAL_TOKEN \
+	INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN \
+	INFISICAL_UNIVERSAL_AUTH_CLIENT_ID \
+	INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET
+
+if [ "$runtime_scope" = app ]; then
+	if [ "$(id -u)" -eq 0 ]; then
+		chown shd-runtime:node "$secret_file" "$shared_secret_file"
+		exec gosu shd-runtime node scripts/runtime-launcher.mjs app "$environment" "$build_number" "$commit_sha" "$secret_file" "$shared_secret_file" -- "$@"
+	fi
+	exec node scripts/runtime-launcher.mjs app "$environment" "$build_number" "$commit_sha" "$secret_file" "$shared_secret_file" -- "$@"
+fi
+if [ "$(id -u)" -eq 0 ]; then
+	chown shd-runtime:node "$secret_file"
+	exec gosu shd-runtime node scripts/runtime-launcher.mjs scheduler "$environment" "$build_number" "$commit_sha" "$secret_file" -- "$@"
+fi
+exec node scripts/runtime-launcher.mjs scheduler "$environment" "$build_number" "$commit_sha" "$secret_file" -- "$@"