update bin/secrets.sh to aid in creating fresh environments with fres…#428
update bin/secrets.sh to aid in creating fresh environments with fres…#428
Conversation
|
|
||
| mkdir -p "$OUTPUT_DIR" | ||
|
|
||
| zrest="${OUTPUT_DIR}/restund_zrest_secret.txt" |
There was a problem hiding this comment.
Great minds think alike. I actually wrote the exact same script yesterday 8f9683f
:)
However I removed the writing to .txt files I wrote the secrets directly to the ansible inventory instead (through a group_vars file).
Perhaps that's also something we want to do here? Then you don't have to copy the secrets into your ansible inventory manually
There was a problem hiding this comment.
Ah well we could have saved some time by not doing that concurrently. Oh well :)
I took your ansible-inventory-generating code from the linked commit and added it here. Thanks! I also took the ZAUTH_CONTAINER idea and integrated it here.
As for the question of saving to text file: well, this PR also adds a basicAuth secret, which needs to be shared via group password manager and is neither used by helm nor by ansible. So at least that one needs its own file. Storing individual secrets in a file makes it easier to re-generate something or change the script. Do you think it's necessary/better to remove the writing-one-secret-to-file?
arianvp
left a comment
arianvp
left a comment
There was a problem hiding this comment.
This looks good! Would you want to add openssl and apacheHttpd to the default.nix file? This will make htpasswd and openssl CLI available for people with direnv and for people using the wire-server-deploy docker container (e.g. in offline deploys)
Will do in a follow-up PR! |
2 participants
…h secrets
Motivation: as I was creating new environments, I needed to create fresh secrets for them, and add them to a secrets.yaml file. This is currently a tedious process involving copy-pasting the right bits of string to the rightly-indented json.
If this PR is accepted, FUTUREWORK could be to A) add the existence of this script to docs.wire.com and B) we could make it even easier by providing a docker image containing zauth, openssl, and htpasswd.