a27b74cf22
- Frontend v4 accessible sur réseau local (192.168.1.40) - Ports ouverts: 3002 (frontend), 5001 (backend), 5004 (dashboard) - Ollama GPU fonctionnel - Self-healing interactif - Dashboard confiance Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
87 lines
1.9 KiB
Bash
Executable File
87 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# server/bootstrap_secrets_env.sh
|
|
#
|
|
# Génère automatiquement les secrets/tokens manquants dans un fichier .env (PROD)
|
|
# sans afficher les valeurs (pour éviter de les leak dans les logs).
|
|
#
|
|
# Usage:
|
|
# sudo ./server/bootstrap_secrets_env.sh /etc/rpa_vision_v3/rpa_vision_v3.env
|
|
|
|
set -euo pipefail
|
|
|
|
ENV_FILE="${1:-/etc/rpa_vision_v3/rpa_vision_v3.env}"
|
|
|
|
if [[ ! -f "$ENV_FILE" ]]; then
|
|
echo "❌ Env file introuvable: $ENV_FILE" >&2
|
|
exit 1
|
|
fi
|
|
|
|
umask 077
|
|
|
|
_has_cmd() { command -v "$1" >/dev/null 2>&1; }
|
|
|
|
_gen_hex_32() {
|
|
# 32 bytes => 64 hex chars
|
|
if _has_cmd openssl; then
|
|
openssl rand -hex 32
|
|
else
|
|
python3 - <<'PY'
|
|
import secrets
|
|
print(secrets.token_hex(32))
|
|
PY
|
|
fi
|
|
}
|
|
|
|
_get_value() {
|
|
local key="$1"
|
|
# Retourne la première occurence KEY=... (sans commentaires)
|
|
grep -E "^${key}=" "$ENV_FILE" 2>/dev/null | head -n 1 | cut -d'=' -f2- || true
|
|
}
|
|
|
|
_is_placeholder() {
|
|
local v="$1"
|
|
[[ -z "$v" ]] && return 0
|
|
[[ "$v" == "CHANGE_ME" ]] && return 0
|
|
[[ "$v" == CHANGE_ME_* ]] && return 0
|
|
[[ "$v" == "rpa_vision_v3_default_key" ]] && return 0
|
|
return 1
|
|
}
|
|
|
|
_set_key() {
|
|
local key="$1"
|
|
local value="$2"
|
|
|
|
if grep -qE "^${key}=" "$ENV_FILE"; then
|
|
# Remplace la ligne complète
|
|
sed -i -E "s|^${key}=.*|${key}=${value}|" "$ENV_FILE"
|
|
else
|
|
echo "${key}=${value}" >> "$ENV_FILE"
|
|
fi
|
|
}
|
|
|
|
_ensure_key() {
|
|
local key="$1"
|
|
local cur
|
|
cur="$(_get_value "$key")"
|
|
if _is_placeholder "$cur"; then
|
|
_set_key "$key" "$(_gen_hex_32)"
|
|
echo "✅ Secret généré: $key"
|
|
else
|
|
echo "✅ Secret OK: $key"
|
|
fi
|
|
}
|
|
|
|
echo "🔐 Bootstrap secrets: $ENV_FILE"
|
|
|
|
# Secrets (toujours utiles)
|
|
_ensure_key "ENCRYPTION_PASSWORD"
|
|
_ensure_key "SECRET_KEY"
|
|
|
|
# Sécurité API (#23)
|
|
_ensure_key "RPA_TOKEN_ADMIN"
|
|
_ensure_key "RPA_TOKEN_READONLY"
|
|
|
|
# AutoHeal admin token (#22)
|
|
_ensure_key "AUTOHEAL_ADMIN_TOKEN"
|
|
|
|
echo "✅ Bootstrap terminé (les valeurs sont écrites dans $ENV_FILE)." |