d80ebe146a
Some checks failed
CI/CD Pipeline / Solidity Contracts (push) Failing after 1m35s
CI/CD Pipeline / Security Scanning (push) Successful in 2m27s
CI/CD Pipeline / Lint and Format (push) Failing after 55s
CI/CD Pipeline / Terraform Validation (push) Failing after 28s
CI/CD Pipeline / Kubernetes Validation (push) Successful in 27s
Deploy ChainID 138 / Deploy ChainID 138 (push) Failing after 46s
Validation / validate-genesis (push) Successful in 35s
Validation / validate-terraform (push) Failing after 27s
Validation / validate-kubernetes (push) Failing after 13s
Validation / validate-smart-contracts (push) Failing after 13s
Validation / validate-security (push) Failing after 1m24s
Validation / validate-documentation (push) Failing after 20s
Verify Deployment / Verify Deployment (push) Failing after 1m9s
Allow nginx auth snippets to use super-admin keys from paired d-bis.org VMIDs (5820→5826 exchange, etc.), generate snippets for all 5820–5828 on deploy, and add build-portal-lxc-env-fragment.sh for sync-time .env push with internal secret. Co-authored-by: Cursor <cursoragent@cursor.com>
56 lines
1.4 KiB
Bash
56 lines
1.4 KiB
Bash
#!/usr/bin/env bash
|
|
# Write nginx auth snippet for portal (injects super-admin Bearer + internal header server-side).
|
|
set -euo pipefail
|
|
|
|
REPO_DIR="${OMNL_BANK_ROOT:-$HOME/smom-dbis-138}"
|
|
ENV_FILE="${OMNL_BANK_ENV:-$REPO_DIR/.env}"
|
|
CTID="${1:-5827}"
|
|
OUT="${2:-$REPO_DIR/deploy/nginx/omnl-portal-auth-${CTID}.conf.inc}"
|
|
AUTH_SOURCE_CTID="${3:-$CTID}"
|
|
|
|
CONFIG="$REPO_DIR/config/omnl-super-admins.v1.json"
|
|
|
|
if [[ ! -f "$ENV_FILE" ]]; then
|
|
echo "Missing $ENV_FILE" >&2
|
|
exit 1
|
|
fi
|
|
|
|
set -a
|
|
set +u
|
|
# shellcheck disable=SC1090
|
|
source "$ENV_FILE"
|
|
set -u
|
|
set +a
|
|
|
|
ENV_KEY="$(node -e "
|
|
const fs = require('fs');
|
|
const cfg = JSON.parse(fs.readFileSync('$CONFIG', 'utf8'));
|
|
const ct = Number('$AUTH_SOURCE_CTID');
|
|
const admin = cfg.superAdmins.find(a => a.portalCtid === ct);
|
|
if (!admin) process.exit(2);
|
|
console.log(admin.envKey);
|
|
")"
|
|
|
|
API_KEY="${!ENV_KEY:-${OMNL_API_KEY:-}}"
|
|
INTERNAL="${OMNL_PORTAL_INTERNAL_SECRET:-}"
|
|
|
|
if [[ -z "$API_KEY" ]]; then
|
|
echo "No API key for CT $CTID (auth source $AUTH_SOURCE_CTID, $ENV_KEY unset)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
AUTH_NOTE="CT $CTID portal upstream auth"
|
|
if [[ "$AUTH_SOURCE_CTID" != "$CTID" ]]; then
|
|
AUTH_NOTE="CT $CTID portal upstream auth (key from CT $AUTH_SOURCE_CTID)"
|
|
fi
|
|
|
|
mkdir -p "$(dirname "$OUT")"
|
|
cat >"$OUT" <<EOF
|
|
# Auto-generated — do not commit. ${AUTH_NOTE}.
|
|
proxy_set_header Authorization "Bearer ${API_KEY}";
|
|
proxy_set_header X-OMNL-Portal-Auth "${INTERNAL}";
|
|
EOF
|
|
|
|
chmod 600 "$OUT"
|
|
echo "Wrote $OUT"
|