113 lines
2.5 KiB
Bash
113 lines
2.5 KiB
Bash
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
# Usage:
|
|
# ./scripts/inject-secrets.sh local
|
|
# ./scripts/inject-secrets.sh staging
|
|
# ./scripts/inject-secrets.sh prod
|
|
|
|
ENV=${1:-local}
|
|
OUTPUT_PATH=${2:-/tmp/config.generated.json}
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
|
TEMPLATE="$REPO_ROOT/config/$ENV/config.json"
|
|
|
|
echo "==> Environment: $ENV"
|
|
echo "==> Template: $TEMPLATE"
|
|
echo "==> Output: $OUTPUT_PATH"
|
|
|
|
# ■■ Validate template exists ■■
|
|
if [ ! -f "$TEMPLATE" ]; then
|
|
echo "ERROR: Config template not found at $TEMPLATE"
|
|
exit 1
|
|
fi
|
|
|
|
# ■■ Load secrets ■■
|
|
if [ "$ENV" = "local" ]; then
|
|
ENV_FILE="$REPO_ROOT/.env.local"
|
|
|
|
if [ ! -f "$ENV_FILE" ]; then
|
|
echo "ERROR: .env.local not found. Copy .env.local.example and fill in your values."
|
|
exit 1
|
|
fi
|
|
|
|
echo "==> Loading local env from $ENV_FILE"
|
|
|
|
set -a
|
|
source "$ENV_FILE"
|
|
set +a
|
|
|
|
else
|
|
echo "==> Fetching secrets from AWS Secrets Manager"
|
|
|
|
AWS_ARGS=(
|
|
secretsmanager get-secret-value
|
|
--secret-id "$ENV/fm-be/config"
|
|
--query SecretString
|
|
--output text
|
|
)
|
|
|
|
if [ -n "${AWS_ENDPOINT_URL:-}" ]; then
|
|
echo "==> Using custom AWS endpoint: $AWS_ENDPOINT_URL"
|
|
AWS_ARGS+=(--endpoint-url "$AWS_ENDPOINT_URL")
|
|
fi
|
|
|
|
SECRET=$(aws "${AWS_ARGS[@]}")
|
|
|
|
eval "$(echo "$SECRET" | jq -r 'to_entries | .[] | "export \(.key)=\(.value)"')"
|
|
fi
|
|
|
|
# ■■ Extract required variables from template ■■
|
|
REQUIRED_VARS=$(grep -o '\${[A-Z0-9_]\+}' "$TEMPLATE" | tr -d '${}' | sort -u)
|
|
|
|
echo "==> Validating required variables..."
|
|
|
|
MISSING=()
|
|
EMPTY=()
|
|
|
|
for var in $REQUIRED_VARS; do
|
|
if [ -z "${!var+set}" ]; then
|
|
MISSING+=("$var")
|
|
elif [ -z "${!var}" ]; then
|
|
EMPTY+=("$var")
|
|
fi
|
|
done
|
|
|
|
if [ ${#MISSING[@]} -gt 0 ]; then
|
|
echo "ERROR: The following variables are not set at all:"
|
|
for v in "${MISSING[@]}"; do
|
|
echo " - $v"
|
|
done
|
|
exit 1
|
|
fi
|
|
|
|
if [ ${#EMPTY[@]} -gt 0 ]; then
|
|
echo "WARNING: The following variables are set but empty:"
|
|
for v in "${EMPTY[@]}"; do
|
|
echo " - $v"
|
|
done
|
|
fi
|
|
|
|
echo "==> All required variables are set"
|
|
|
|
# ■■ Safe substitution (only replace known vars) ■■
|
|
VARS=$(printf '${%s} ' $REQUIRED_VARS)
|
|
|
|
envsubst "$VARS" < "$TEMPLATE" > "$OUTPUT_PATH"
|
|
|
|
echo "==> Config generated at $OUTPUT_PATH"
|
|
|
|
# ■■ Validate JSON ■■
|
|
if ! jq empty "$OUTPUT_PATH" 2>/dev/null; then
|
|
echo "ERROR: Generated config is not valid JSON"
|
|
echo "==> jq diagnostics:"
|
|
jq empty "$OUTPUT_PATH" || true
|
|
rm -f "$OUTPUT_PATH"
|
|
exit 1
|
|
fi
|
|
|
|
echo "==> JSON validation passed"
|
|
|
|
echo "==> Done."
|