hotel-manage-stack/stack-init
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

gen_secrets: reuse existing credentials on re-run (resume-safe)

Browse source
This commit is contained in:
jtricerolph 2026-07-01 13:02:25 +00:00
parent 5e11c1e207
commit 29e38361c8
1 changed files with 20 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

24
install-stack.sh
View file

@ -213,7 +213,22 @@ Proceed?" 24 58 || exit 0
} }
# ── Generate secrets ────────────────────────────────────────────────────────── # ── Generate secrets ──────────────────────────────────────────────────────────
CREDS_FILE=/root/hotel-manage-credentials.txt
gen_secrets() { gen_secrets() {
# Resume-safe: if secrets already exist, reuse them so a re-run doesn't
# mismatch an already-initialised Postgres / already-deployed services.
if [[ -f "$CREDS_FILE" ]] && grep -q '^PG_SUPERPASS=' "$CREDS_FILE"; then
msg_info "Reusing existing secrets from $CREDS_FILE"
PG_SUPERPASS=$(sed -n 's/^PG_SUPERPASS=//p' "$CREDS_FILE" | head -1)
AUTH_DB_PASS=$(sed -n 's/^AUTH_DB_PASS=//p' "$CREDS_FILE" | head -1)
NOTICES_DB_PASS=$(sed -n 's/^NOTICES_DB_PASS=//p' "$CREDS_FILE" | head -1)
CENTRAL_AUTH_SECRET=$(sed -n 's/^CENTRAL_AUTH_SECRET=//p' "$CREDS_FILE" | head -1)
WEBHOOK_SECRET=$(sed -n 's/^WEBHOOK_SECRET=//p' "$CREDS_FILE" | head -1)
NPM_ADMIN_PASS=$(sed -n 's/^NPM_ADMIN_PASS=//p' "$CREDS_FILE" | head -1)
msg_ok "Reusing existing secrets"
return
fi
msg_info "Generating secrets" msg_info "Generating secrets"
PG_SUPERPASS=$(openssl rand -base64 24 | tr -dc 'a-zA-Z0-9' | head -c 24) PG_SUPERPASS=$(openssl rand -base64 24 | tr -dc 'a-zA-Z0-9' | head -c 24)
AUTH_DB_PASS=$(openssl rand -base64 24 | tr -dc 'a-zA-Z0-9' | head -c 24) AUTH_DB_PASS=$(openssl rand -base64 24 | tr -dc 'a-zA-Z0-9' | head -c 24)
@ -222,7 +237,7 @@ gen_secrets() {
WEBHOOK_SECRET=$(openssl rand -hex 24) WEBHOOK_SECRET=$(openssl rand -hex 24)
NPM_ADMIN_PASS=$(openssl rand -base64 12 | tr -dc 'a-zA-Z0-9' | head -c 12) NPM_ADMIN_PASS=$(openssl rand -base64 12 | tr -dc 'a-zA-Z0-9' | head -c 12)
cat > /root/hotel-manage-credentials.txt <<EOF cat > "$CREDS_FILE" <<EOF
# Hotel Manage credentials — generated $(date '+%Y-%m-%d %H:%M') # Hotel Manage credentials — generated $(date '+%Y-%m-%d %H:%M')
# !! KEEP THIS FILE SAFE — store a copy offsite !! # !! KEEP THIS FILE SAFE — store a copy offsite !!
@ -246,8 +261,8 @@ FORGEJO_TOKEN=${FORGEJO_TOKEN}
BACKUP_REMOTE=${BACKUP_REMOTE} BACKUP_REMOTE=${BACKUP_REMOTE}
EOF EOF
chmod 600 /root/hotel-manage-credentials.txt chmod 600 "$CREDS_FILE"
msg_ok "Secrets generated → /root/hotel-manage-credentials.txt" msg_ok "Secrets generated → $CREDS_FILE"
} }
# ── SSH keypair for management → app LXCs ──────────────────────────────────── # ── SSH keypair for management → app LXCs ────────────────────────────────────
@ -261,7 +276,8 @@ gen_mgmt_ssh_key() {
msg_ok "Using existing SSH keypair at /root/.ssh/hotel-manage_deploy" msg_ok "Using existing SSH keypair at /root/.ssh/hotel-manage_deploy"
fi fi
MGMT_PUBKEY=$(cat /root/.ssh/hotel-manage_deploy.pub) MGMT_PUBKEY=$(cat /root/.ssh/hotel-manage_deploy.pub)
echo "${MGMT_PUBKEY}" >> /root/hotel-manage-credentials.txt # record the pubkey once (don't duplicate on re-run)
grep -qF "${MGMT_PUBKEY}" "$CREDS_FILE" 2>/dev/null || echo "${MGMT_PUBKEY}" >> "$CREDS_FILE"
} }
# ── LXC lifecycle helpers ───────────────────────────────────────────────────── # ── LXC lifecycle helpers ─────────────────────────────────────────────────────