| 1 | #!/usr/bin/env python3 |
| 2 | import os |
| 3 | from pathlib import Path |
| 4 | import re |
| 5 | import subprocess |
| 6 | |
| 7 | |
| 8 | if not os.environ.get("STUDIO_DEPLOY_HOST"): |
| 9 | raise SystemExit("Set STUDIO_DEPLOY_HOST to the production target") |
| 10 | |
| 11 | if os.environ.get("STUDIO_LEGACY_HANDOFF"): |
| 12 | ssh = ["ssh", "-o", "BatchMode=yes", "-p", os.environ.get("STUDIO_DEPLOY_PORT", "22"), os.environ["STUDIO_DEPLOY_HOST"]] |
| 13 | else: |
| 14 | ssh = ["ssh", "-o", "BatchMode=yes", os.environ.get("STUDIO_MIGRATION_SOURCE", "zenith")] |
| 15 | |
| 16 | source = subprocess.run( |
| 17 | [*ssh, "cat", "/mnt/storage1/apps/home-infra/.env"], |
| 18 | check=True, capture_output=True, text=True, |
| 19 | ).stdout |
| 20 | names = { |
| 21 | "PDS_JWT_SECRET": "jwt_secret", |
| 22 | "PDS_ADMIN_PASSWORD": "admin_password", |
| 23 | "PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX": "plc_rotation_key", |
| 24 | "MAILER_ADDRESS": "mailer_address", |
| 25 | "MAILER_USERNAME": "mailer_username", |
| 26 | "MAILER_PASSWORD": "mailer_password", |
| 27 | } |
| 28 | values = {} |
| 29 | for line in source.splitlines(): |
| 30 | key, separator, value = line.partition("=") |
| 31 | key = key.strip() |
| 32 | if separator and key in names: |
| 33 | if names[key] in values: |
| 34 | raise ValueError(f"duplicate source secret: {key}") |
| 35 | values[names[key]] = value.strip() |
| 36 | if len(values) != len(names) or not all(values.values()): |
| 37 | raise ValueError("PDS source secrets are incomplete") |
| 38 | if not re.fullmatch(r"[0-9a-fA-F]{64}", values["plc_rotation_key"]): |
| 39 | raise ValueError("invalid PDS rotation key") |
| 40 | |
| 41 | subprocess.run( |
| 42 | ["python3", str(Path(__file__).with_name("deploy.py")), "secrets", "pds", "--file", "-"], |
| 43 | input="".join(values[name] + "\n" for name in names.values()), text=True, check=True, |
| 44 | ) |