ml
a462ff1729
- ansible.cfg: suppress Python interpreter discovery warning - ansible/inventory.ini: add ansible_host; server IP is now defined in one place and read dynamically by run-bootstrap.sh - group_vars/all/ → directory layout so vault.yml is auto-loaded by Ansible (previously vault.yml did not match any group name and was silently ignored) - scripts/run-bootstrap.sh: read server IP from inventory, chmod 600 private keys automatically, show actual SSH error when root login fails - scripts/bootstrap-deploy-user.sh: add sudoers.d entry for passwordless sudo (deploy user has no password so sudo group membership alone was not enough) - nextcloud: fix Redis healthcheck (CMD-SHELL pipe was unreliable in Alpine, switched to CMD form with start_period) - group_vars/all/vars.yml: fix Roundcube image tag (1.6-apache and 1.6 do not exist; correct tag is 1.6.x-apache) - docs/runbook.md: expand prerequisites (SSH keys section), add step 1 for setting the server IP, expand bootstrap step with preflight detail, fix step numbering
60 lines
1.7 KiB
Bash
Executable File
60 lines
1.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Decrypts ansible/group_vars/vault.yml and checks all required secrets are present
|
|
# and non-empty. Exits non-zero if any are missing.
|
|
# Usage: bash scripts/check-vault.sh
|
|
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
|
|
VAULT_FILE="${REPO_ROOT}/ansible/group_vars/all/vault.yml"
|
|
|
|
REQUIRED_KEYS=(
|
|
traefik_dashboard_users
|
|
gitea_db_password
|
|
gitea_secret_key
|
|
gitea_internal_token
|
|
keycloak_db_password
|
|
keycloak_admin_password
|
|
nextcloud_db_password
|
|
nextcloud_admin_password
|
|
roundcube_db_password
|
|
roundcube_des_key
|
|
registry_htpasswd
|
|
)
|
|
|
|
if [ ! -f "${VAULT_FILE}" ]; then
|
|
echo "ERROR: vault file not found at ${VAULT_FILE}" >&2
|
|
echo " Create it with: ansible-vault create ansible/group_vars/vault.yml" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! command -v ansible-vault &>/dev/null; then
|
|
echo "ERROR: ansible-vault not found — install with: pip install ansible" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "==> Decrypting vault (you will be prompted for the vault password)"
|
|
VAULT_CONTENT=$(ansible-vault view "${VAULT_FILE}")
|
|
|
|
MISSING=()
|
|
for key in "${REQUIRED_KEYS[@]}"; do
|
|
# Match lines like: key: "value" or key: value — but not key: "" or key: '' or missing
|
|
if ! echo "${VAULT_CONTENT}" | grep -qE "^${key}:[[:space:]]+[^'\"[:space:]]|^${key}:[[:space:]]+['\"].+['\"]"; then
|
|
MISSING+=("${key}")
|
|
fi
|
|
done
|
|
|
|
if [ ${#MISSING[@]} -gt 0 ]; then
|
|
echo "" >&2
|
|
echo "ERROR: the following secrets are missing or empty in vault.yml:" >&2
|
|
for key in "${MISSING[@]}"; do
|
|
echo " - ${key}" >&2
|
|
done
|
|
echo "" >&2
|
|
echo "Edit the vault with: ansible-vault edit ansible/group_vars/vault.yml" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo " OK — all required secrets are present"
|