ml
187c6bdea4
- Add local Dovecot IMAP server exposed via Traefik IMAPS on port 993; Roundcube now connects to it internally instead of requiring manual server entry - Add Fetchmail integration for pulling from external POP3 accounts with configurable per-account poll interval - Fix Gitea SSO registration: DISABLE_REGISTRATION=false + ALLOW_ONLY_EXTERNAL_REGISTRATION allows Keycloak-authenticated users to get accounts while blocking public sign-up; disable legacy OpenID 2.0 sign-in - Fix Keycloak post-logout redirect for Nextcloud (valid post logout redirect URI) - Replace all pre-hashed credentials (Traefik dashboard, registry, Dovecot) with plaintext passwords in vault; Ansible generates deterministic bcrypt/SHA-512 hashes at deploy time — no more manual htpasswd commands - Rewrite check-vault.sh with Python/PyYAML to properly validate both scalar and list-type secrets - Update provisioning and configuration runbooks throughout
74 lines
2.1 KiB
Bash
Executable File
74 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Decrypts ansible/group_vars/vault.yml and checks all required secrets are present
|
|
# and non-empty. Exits non-zero if any are missing.
|
|
# Usage: bash scripts/check-vault.sh
|
|
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
|
|
VAULT_FILE="${REPO_ROOT}/ansible/group_vars/all/vault.yml"
|
|
|
|
if [ ! -f "${VAULT_FILE}" ]; then
|
|
echo "ERROR: vault file not found at ${VAULT_FILE}" >&2
|
|
echo " Create it with: ansible-vault create ansible/group_vars/all/vault.yml" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! command -v ansible-vault &>/dev/null; then
|
|
echo "ERROR: ansible-vault not found — install with: pip install ansible" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "==> Decrypting vault (you will be prompted for the vault password)"
|
|
VAULT_CONTENT=$(ansible-vault view "${VAULT_FILE}")
|
|
|
|
echo "${VAULT_CONTENT}" | python3 - <<'PYEOF'
|
|
import sys, yaml
|
|
|
|
data = yaml.safe_load(sys.stdin.read())
|
|
|
|
# Required non-empty scalar strings
|
|
required_scalars = [
|
|
"gitea_db_password",
|
|
"gitea_secret_key",
|
|
"gitea_internal_token",
|
|
"keycloak_db_password",
|
|
"keycloak_admin_password",
|
|
"nextcloud_db_password",
|
|
"nextcloud_admin_password",
|
|
"roundcube_db_password",
|
|
"roundcube_des_key",
|
|
]
|
|
|
|
# Required non-empty lists (must contain at least one entry)
|
|
required_lists = [
|
|
"traefik_dashboard_users",
|
|
"registry_users",
|
|
"dovecot_users",
|
|
]
|
|
|
|
missing = []
|
|
|
|
for key in required_scalars:
|
|
val = data.get(key, "")
|
|
if not val or str(val).strip() in ("", '""', "''"):
|
|
missing.append(key)
|
|
|
|
for key in required_lists:
|
|
val = data.get(key)
|
|
if not isinstance(val, list) or len(val) == 0:
|
|
missing.append(key)
|
|
|
|
if missing:
|
|
print("", file=sys.stderr)
|
|
print("ERROR: the following secrets are missing or empty in vault.yml:", file=sys.stderr)
|
|
for key in missing:
|
|
print(f" - {key}", file=sys.stderr)
|
|
print("", file=sys.stderr)
|
|
print("Edit the vault with: ansible-vault edit ansible/group_vars/all/vault.yml", file=sys.stderr)
|
|
sys.exit(1)
|
|
|
|
print(" OK — all required secrets are present")
|
|
PYEOF
|