32 lines
1.0 KiB
Bash
32 lines
1.0 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
# Pushes a project's first env file and grants read-only access to one
|
||
|
|
# or more already-registered recipients (typically the VPS boxes that
|
||
|
|
# will deploy it), in one call.
|
||
|
|
#
|
||
|
|
# Usage:
|
||
|
|
# ./bootstrap-project.sh <vault> <env-file> <recipient-id> [recipient-id...]
|
||
|
|
#
|
||
|
|
# The pusher (this machine's identity) becomes the vault's first,
|
||
|
|
# read-write recipient automatically — see IMPLEMENTATION.md. Every
|
||
|
|
# recipient-id argument here is granted read-only; run `keep grant`
|
||
|
|
# by hand afterward for anyone who needs write access too.
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
vault="${1:?usage: bootstrap-project.sh <vault> <env-file> <recipient-id> [recipient-id...]}"
|
||
|
|
file="${2:?usage: bootstrap-project.sh <vault> <env-file> <recipient-id> [recipient-id...]}"
|
||
|
|
shift 2
|
||
|
|
|
||
|
|
if [ "$#" -eq 0 ]; then
|
||
|
|
echo "error: at least one recipient id is required" >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
keep push "$vault" --file "$file"
|
||
|
|
|
||
|
|
for recipient in "$@"; do
|
||
|
|
keep grant "$vault" "$recipient" --read-only
|
||
|
|
done
|
||
|
|
|
||
|
|
echo ""
|
||
|
|
echo "done. verify with: KEEP_ADMIN_PASSWORD=... keep overview"
|