Add script to handle secrets fetching
This commit is contained in:
Mo Tarbin
71
scripts/pull-secrets.sh
Executable file
71
scripts/pull-secrets.sh
Executable file
@@ -0,0 +1,71 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
||||
BW_SERVER="${BW_SERVER:-https://bitwarden.com}"
|
||||
|
||||
# ── Auth ──────────────────────────────────────────────────────────────────────
|
||||
echo "→ Connecting to Vaultwarden at $BW_SERVER"
|
||||
CURRENT_SERVER=$(bw status | jq -r '.serverUrl // empty')
|
||||
|
||||
if [ "$CURRENT_SERVER" != "$BW_SERVER" ]; then
|
||||
bw logout || true
|
||||
bw config server "$BW_SERVER"
|
||||
fi
|
||||
|
||||
if [ -z "${BW_SESSION:-}" ]; then
|
||||
BW_LOGIN_STATUS=$(bw status | jq -r '.status')
|
||||
|
||||
if [ "$BW_LOGIN_STATUS" = "unauthenticated" ]; then
|
||||
if [ -n "${BW_CLIENTID:-}" ] && [ -n "${BW_CLIENTSECRET:-}" ]; then
|
||||
bw login --apikey
|
||||
else
|
||||
bw login
|
||||
fi
|
||||
fi
|
||||
|
||||
export BW_SESSION=$(bw unlock --passwordenv BW_PASSWORD --raw)
|
||||
fi
|
||||
|
||||
bw sync --session "$BW_SESSION" > /dev/null
|
||||
|
||||
# ── Helper ────────────────────────────────────────────────────────────────────
|
||||
get_note() {
|
||||
bw get item "$1" --session "$BW_SESSION" | jq -r '.notes'
|
||||
}
|
||||
|
||||
get_password() {
|
||||
bw get item "$1" --session "$BW_SESSION" | jq -r '.login.password // .notes'
|
||||
}
|
||||
|
||||
# ── Android ───────────────────────────────────────────────────────────────────
|
||||
echo "→ Writing android/app/google-services.json"
|
||||
get_note "Donetick Google Services Android" > "$REPO_ROOT/android/app/google-services.json"
|
||||
|
||||
echo "→ Writing android keystore"
|
||||
get_note "Donetick Android Keystore" | base64 --decode > "$REPO_ROOT/android/app/release/donetick.jks"
|
||||
|
||||
KEYSTORE_PASSWORD=$(get_password "Donetick Keystore Password")
|
||||
|
||||
cat > "$REPO_ROOT/android/keystore.properties" <<EOF
|
||||
storeFile=release/donetick.jks
|
||||
storePassword=$KEYSTORE_PASSWORD
|
||||
keyAlias=key0
|
||||
keyPassword=$KEYSTORE_PASSWORD
|
||||
EOF
|
||||
|
||||
echo "→ Writing android/play-service-account.json"
|
||||
get_note "Donetick Google Play Service Account" > "$REPO_ROOT/android/play-service-account.json"
|
||||
|
||||
# ── iOS ───────────────────────────────────────────────────────────────────────
|
||||
echo "→ Writing ios/App/App/GoogleService-Info.plist"
|
||||
get_note "Donetick Google Services iOS" > "$REPO_ROOT/ios/App/App/GoogleService-Info.plist"
|
||||
|
||||
echo "→ Writing App Store Connect key"
|
||||
get_note "Donetick App Store Connect Key" | base64 --decode > "$REPO_ROOT/ios/AuthKey_84F695CDQ3.p8"
|
||||
|
||||
# ── Env ───────────────────────────────────────────────────────────────────────
|
||||
echo "→ Writing .env.production"
|
||||
get_note "Donetick Env Production" > "$REPO_ROOT/.env.production"
|
||||
|
||||
echo "✓ All secrets pulled successfully"
|
||||
69
scripts/push-secrets.sh
Executable file
69
scripts/push-secrets.sh
Executable file
@@ -0,0 +1,69 @@
|
||||
#!/usr/bin/env bash
|
||||
# One-time script to upload local secrets into Vaultwarden.
|
||||
set -euo pipefail
|
||||
|
||||
REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
||||
# BW_SERVER="${BW_SERVER:-https://www.bitwareden.com}"
|
||||
|
||||
# ── Auth ──────────────────────────────────────────────────────────────────────
|
||||
# bw config server "$BW_SERVER"
|
||||
# bw login
|
||||
export BW_SESSION=$(bw unlock --passwordenv BW_PASSWORD --raw)
|
||||
|
||||
# ── Helper ────────────────────────────────────────────────────────────────────
|
||||
upsert_secure_note() {
|
||||
local name="$1"
|
||||
local content="$2"
|
||||
local existing_id
|
||||
existing_id=$(bw list items --session "$BW_SESSION" | jq -r --arg n "$name" '.[] | select(.name == $n) | .id' | head -1)
|
||||
|
||||
if [[ -n "$existing_id" ]]; then
|
||||
bw get item "$existing_id" --session "$BW_SESSION" \
|
||||
| jq --arg c "$content" '.notes = $c' \
|
||||
| bw encode \
|
||||
| bw edit item "$existing_id" --session "$BW_SESSION" > /dev/null
|
||||
echo " ✓ Updated: $name"
|
||||
else
|
||||
bw get template item --session "$BW_SESSION" \
|
||||
| jq --arg n "$name" --arg c "$content" \
|
||||
'.name = $n | .type = 2 | .secureNote = {"type":0} | .notes = $c' \
|
||||
| bw encode \
|
||||
| bw create item --session "$BW_SESSION" > /dev/null
|
||||
echo " ✓ Created: $name"
|
||||
fi
|
||||
}
|
||||
|
||||
# ── Upload ────────────────────────────────────────────────────────────────────
|
||||
echo "→ Uploading Android google-services.json"
|
||||
upsert_secure_note \
|
||||
"Donetick Google Services Android" \
|
||||
"$(cat "$REPO_ROOT/android/app/google-services.json")"
|
||||
|
||||
echo "→ Uploading Fastline google-services.json"
|
||||
upsert_secure_note \
|
||||
"Donetick Google Play Service Account" \
|
||||
"$(cat "$REPO_ROOT/donetick-5f910-5688a280a65a--fastline.json")"
|
||||
|
||||
echo "→ Uploading Android keystore (base64)"
|
||||
upsert_secure_note \
|
||||
"Donetick Android Keystore" \
|
||||
"$(base64 < /Users/mohamad-macbook-air/donetick-android-ley)"
|
||||
|
||||
echo "→ Uploading iOS GoogleService-Info.plist"
|
||||
upsert_secure_note \
|
||||
"Donetick Google Services iOS" \
|
||||
"$(cat "$REPO_ROOT/ios/App/App/GoogleService-Info.plist")"
|
||||
|
||||
echo "→ Uploading App Store Connect key (base64)"
|
||||
upsert_secure_note \
|
||||
"Donetick App Store Connect Key" \
|
||||
"$(base64 < /Users/mohamad-macbook-air/Downloads/AuthKey_84F695CDQ3.p8)"
|
||||
|
||||
echo "→ Uploading .env.production"
|
||||
upsert_secure_note \
|
||||
"Donetick Env Production" \
|
||||
"$(cat "$REPO_ROOT/.env.production")"
|
||||
|
||||
echo ""
|
||||
echo "✓ All secrets uploaded. Verify in Vaultwarden, then you can safely delete local copies outside the repo."
|
||||
echo " NOTE: 'Donetick Keystore Password' should already exist — if not, create it manually as a Login item."
|
||||
Reference in New Issue
Block a user