119 lines
4.0 KiB
Bash
119 lines
4.0 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
project_id=${INFISICAL_PROJECT_ID:?INFISICAL_PROJECT_ID is required}
|
|
environment=${INFISICAL_ENVIRONMENT:?INFISICAL_ENVIRONMENT is required}
|
|
runtime_scope=${INFISICAL_RUNTIME_SCOPE:?INFISICAL_RUNTIME_SCOPE is required}
|
|
client_id_file=${INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_FILE:?INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_FILE is required}
|
|
client_secret_file=${INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET_FILE:?INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET_FILE is required}
|
|
build_number=${SHD_BUILD_NUMBER:-0}
|
|
commit_sha=${SHD_COMMIT_SHA:-}
|
|
secret_file=
|
|
shared_secret_file=
|
|
|
|
cleanup() {
|
|
if [ -n "$secret_file" ]; then rm -f "$secret_file"; fi
|
|
if [ -n "$shared_secret_file" ]; then rm -f "$shared_secret_file"; fi
|
|
}
|
|
|
|
trap cleanup EXIT
|
|
trap 'exit 129' HUP
|
|
trap 'exit 130' INT
|
|
trap 'exit 143' TERM
|
|
|
|
if [ ! -r "$client_id_file" ] || [ ! -r "$client_secret_file" ]; then
|
|
echo "Infisical Universal Auth credential files are not readable." >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [ "$(id -u)" -eq 0 ]; then
|
|
runtime_uid=$(id -u shd-runtime)
|
|
for credential_file in "$client_id_file" "$client_secret_file"; do
|
|
credential_uid=$(stat -c '%u' "$credential_file")
|
|
credential_mode=$(stat -c '%a' "$credential_file")
|
|
if [ "$credential_uid" -eq "$runtime_uid" ] || [ $((credential_mode % 100)) -ne 0 ]; then
|
|
echo "Infisical credential files must not be readable by the application runtime user." >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
if [ "$runtime_scope" = app ] && ! { [ "${1:-}" = node ] && [ "${2:-}" = scripts/validate-runtime-environment.mjs ]; }; then
|
|
chgrp -R node /app/data
|
|
chmod -R g+rwX /app/data
|
|
fi
|
|
fi
|
|
|
|
client_id=$(cat "$client_id_file")
|
|
client_secret=$(cat "$client_secret_file")
|
|
if [ -z "$client_id" ] || [ -z "$client_secret" ]; then
|
|
echo "Infisical Universal Auth credential files must not be empty." >&2
|
|
exit 1
|
|
fi
|
|
|
|
unset INFISICAL_TOKEN INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN TOKEN
|
|
access_token=$(
|
|
INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="$client_id" \
|
|
INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="$client_secret" \
|
|
infisical login --method=universal-auth --silent --plain
|
|
)
|
|
unset client_id client_secret
|
|
|
|
if [ -z "$access_token" ]; then
|
|
echo "Infisical Universal Auth returned an empty access token." >&2
|
|
exit 1
|
|
fi
|
|
|
|
umask 077
|
|
secret_file=$(mktemp /tmp/shd-infisical-app.XXXXXX)
|
|
|
|
case "$runtime_scope" in
|
|
app)
|
|
INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN="$access_token" infisical export \
|
|
--projectId="$project_id" \
|
|
--env="$environment" \
|
|
--path=/app \
|
|
--format=json \
|
|
--output-file="$secret_file" \
|
|
--silent
|
|
shared_secret_file=$(mktemp /tmp/shd-infisical-shared.XXXXXX)
|
|
INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN="$access_token" infisical export \
|
|
--projectId="$project_id" \
|
|
--env="$environment" \
|
|
--path=/shared/scheduler \
|
|
--format=json \
|
|
--output-file="$shared_secret_file" \
|
|
--silent
|
|
;;
|
|
scheduler)
|
|
INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN="$access_token" infisical export \
|
|
--projectId="$project_id" \
|
|
--env="$environment" \
|
|
--path=/shared/scheduler \
|
|
--format=json \
|
|
--output-file="$secret_file" \
|
|
--silent
|
|
;;
|
|
*)
|
|
echo "Unsupported INFISICAL_RUNTIME_SCOPE: $runtime_scope" >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
|
|
unset access_token \
|
|
INFISICAL_TOKEN \
|
|
INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN \
|
|
INFISICAL_UNIVERSAL_AUTH_CLIENT_ID \
|
|
INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET
|
|
|
|
if [ "$runtime_scope" = app ]; then
|
|
if [ "$(id -u)" -eq 0 ]; then
|
|
chown shd-runtime:node "$secret_file" "$shared_secret_file"
|
|
exec gosu shd-runtime node scripts/runtime-launcher.mjs app "$environment" "$build_number" "$commit_sha" "$secret_file" "$shared_secret_file" -- "$@"
|
|
fi
|
|
exec node scripts/runtime-launcher.mjs app "$environment" "$build_number" "$commit_sha" "$secret_file" "$shared_secret_file" -- "$@"
|
|
fi
|
|
if [ "$(id -u)" -eq 0 ]; then
|
|
chown shd-runtime:node "$secret_file"
|
|
exec gosu shd-runtime node scripts/runtime-launcher.mjs scheduler "$environment" "$build_number" "$commit_sha" "$secret_file" -- "$@"
|
|
fi
|
|
exec node scripts/runtime-launcher.mjs scheduler "$environment" "$build_number" "$commit_sha" "$secret_file" -- "$@"
|