442c3b7cf5
All checks were successful
Docker / build-and-push (push) Successful in 1m58s
SETUP.local.md.example is a fill-in-the-blanks runbook for rolling keep out across real machines and projects (gitignored once copied to SETUP.local.md — real vault keys/recipient ids/hostnames are fleet topology, not something to commit). bootstrap-project.sh wraps push + grant --read-only for one or more recipients into a single call for onboarding a new project vault. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
32 lines
1.0 KiB
Bash
Executable File
32 lines
1.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Pushes a project's first env file and grants read-only access to one
|
|
# or more already-registered recipients (typically the VPS boxes that
|
|
# will deploy it), in one call.
|
|
#
|
|
# Usage:
|
|
# ./bootstrap-project.sh <vault> <env-file> <recipient-id> [recipient-id...]
|
|
#
|
|
# The pusher (this machine's identity) becomes the vault's first,
|
|
# read-write recipient automatically — see IMPLEMENTATION.md. Every
|
|
# recipient-id argument here is granted read-only; run `keep grant`
|
|
# by hand afterward for anyone who needs write access too.
|
|
set -euo pipefail
|
|
|
|
vault="${1:?usage: bootstrap-project.sh <vault> <env-file> <recipient-id> [recipient-id...]}"
|
|
file="${2:?usage: bootstrap-project.sh <vault> <env-file> <recipient-id> [recipient-id...]}"
|
|
shift 2
|
|
|
|
if [ "$#" -eq 0 ]; then
|
|
echo "error: at least one recipient id is required" >&2
|
|
exit 1
|
|
fi
|
|
|
|
keep push "$vault" --file "$file"
|
|
|
|
for recipient in "$@"; do
|
|
keep grant "$vault" "$recipient" --read-only
|
|
done
|
|
|
|
echo ""
|
|
echo "done. verify with: KEEP_ADMIN_PASSWORD=... keep overview"
|