mirror of
https://github.com/aaronpo97/the-biergarten-app.git
synced 2026-10-14 17:54:42 +00:00
92 lines
3.3 KiB
Bash
Executable File
92 lines
3.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# generate_env.sh
|
|
#
|
|
# Generates a Biergarten App environment file with freshly randomized
|
|
# secrets (DB password, JWT signing secrets, SMTP credentials), based on
|
|
# the .env.example template. Non-secret configuration values are left
|
|
# untouched so the file still matches the documented template structure.
|
|
#
|
|
# Usage:
|
|
# ./generate_env.sh [output_file] [template_file]
|
|
#
|
|
# output_file Path to write the generated env file to (default: .env)
|
|
# template_file Path to the source template (default: .env.example)
|
|
|
|
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
OUTPUT_FILE="${1:-.env}"
|
|
TEMPLATE_FILE="${2:-.env.example}"
|
|
|
|
if ! command -v openssl >/dev/null 2>&1; then
|
|
echo "Error: openssl is required but was not found on PATH." >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ ! -f "$TEMPLATE_FILE" ]]; then
|
|
echo "Error: template file '$TEMPLATE_FILE' not found." >&2
|
|
echo "Pass the template path explicitly: ./generate_env.sh <output> <template>" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ -f "$OUTPUT_FILE" ]]; then
|
|
read -r -p "Warning: '$OUTPUT_FILE' already exists. Overwrite? [y/N] " confirm
|
|
if [[ ! "$confirm" =~ ^[Yy]$ ]]; then
|
|
echo "Aborted. No file was written."
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
gen_jwt_secret() {
|
|
openssl rand -base64 32 | tr -d '\n'
|
|
}
|
|
|
|
gen_password() {
|
|
printf '%s!' "$(openssl rand -hex 24)"
|
|
}
|
|
|
|
gen_username() {
|
|
openssl rand -hex 6
|
|
}
|
|
|
|
DB_PASSWORD_VAL=$(gen_password)
|
|
|
|
DB_SERVER_VAL=$(grep -m1 '^DB_SERVER=' "$TEMPLATE_FILE" | cut -d= -f2-)
|
|
DB_NAME_VAL=$(grep -m1 '^DB_NAME=' "$TEMPLATE_FILE" | cut -d= -f2-)
|
|
DB_USER_VAL=$(grep -m1 '^DB_USER=' "$TEMPLATE_FILE" | cut -d= -f2-)
|
|
DB_CONNECTION_STRING_VAL="Server=${DB_SERVER_VAL};Database=${DB_NAME_VAL};User Id=${DB_USER_VAL};Password=${DB_PASSWORD_VAL};TrustServerCertificate=True;"
|
|
|
|
ACCESS_TOKEN_SECRET_VAL=$(gen_jwt_secret)
|
|
REFRESH_TOKEN_SECRET_VAL=$(gen_jwt_secret)
|
|
CONFIRMATION_TOKEN_SECRET_VAL=$(gen_jwt_secret)
|
|
SESSION_SECRET_VAL=$(gen_jwt_secret)
|
|
SMTP_USERNAME_VAL="smtp_$(gen_username)"
|
|
SMTP_PASSWORD_VAL=$(gen_password)
|
|
SEAWEEDFS_ACCESS_KEY_ID_VAL=$(gen_username)
|
|
SEAWEEDFS_SECRET_ACCESS_KEY_VAL=$(gen_password)
|
|
|
|
cp "$TEMPLATE_FILE" "$OUTPUT_FILE"
|
|
|
|
TMP_FILE="$(mktemp)"
|
|
sed \
|
|
-e "s|^DB_PASSWORD=.*|DB_PASSWORD=${DB_PASSWORD_VAL}|" \
|
|
-e "s|^# DB_CONNECTION_STRING=.*|# DB_CONNECTION_STRING=${DB_CONNECTION_STRING_VAL}|" \
|
|
-e "s|^ACCESS_TOKEN_SECRET=.*|ACCESS_TOKEN_SECRET=${ACCESS_TOKEN_SECRET_VAL}|" \
|
|
-e "s|^REFRESH_TOKEN_SECRET=.*|REFRESH_TOKEN_SECRET=${REFRESH_TOKEN_SECRET_VAL}|" \
|
|
-e "s|^CONFIRMATION_TOKEN_SECRET=.*|CONFIRMATION_TOKEN_SECRET=${CONFIRMATION_TOKEN_SECRET_VAL}|" \
|
|
-e "s|^SESSION_SECRET=.*|SESSION_SECRET=${SESSION_SECRET_VAL}|" \
|
|
-e "s|^SMTP_USERNAME=.*|SMTP_USERNAME=${SMTP_USERNAME_VAL}|" \
|
|
-e "s|^SMTP_PASSWORD=.*|SMTP_PASSWORD=${SMTP_PASSWORD_VAL}|" \
|
|
-e "s|^SEAWEEDFS_ACCESS_KEY_ID=.*|SEAWEEDFS_ACCESS_KEY_ID=${SEAWEEDFS_ACCESS_KEY_ID_VAL}|" \
|
|
-e "s|^SEAWEEDFS_SECRET_ACCESS_KEY=.*|SEAWEEDFS_SECRET_ACCESS_KEY=${SEAWEEDFS_SECRET_ACCESS_KEY_VAL}|" \
|
|
"$OUTPUT_FILE" > "$TMP_FILE"
|
|
mv "$TMP_FILE" "$OUTPUT_FILE"
|
|
|
|
chmod 600 "$OUTPUT_FILE"
|
|
|
|
echo "Generated '$OUTPUT_FILE' with fresh random secrets (file permissions set to 600)."
|
|
echo "Reminder: SMTP_USERNAME/SMTP_PASSWORD were randomized as dev placeholders."
|
|
echo "For staging/production, replace them with real credentials from your SMTP provider."
|