A tester : la génération des mots de passe !
This commit is contained in:
@@ -2,9 +2,10 @@
|
||||
|
||||
# certbot certonly --manual --preferred-challenges=dns --manual-auth-hook certbot-dns-alwaysdata.sh --manual-cleanup-hook certbot-dns-alwaysdata.sh -d "*.kaz.bzh" -d "kaz.bzh"
|
||||
|
||||
ALWAYSDATA_TOKEN="TOKEN"
|
||||
ALWAYSDATA_ACCOUNT="ACCOUNT"
|
||||
ALWAYSDATA_API="https://api.alwaysdata.com/v1/"
|
||||
export KAZ_ROOT=$(cd "$(dirname $0)/.."; pwd)
|
||||
. "${KAZ_ROOT}/bin/.commonFunctions.sh"
|
||||
setKazVars
|
||||
. $KAZ_KEY_DIR/env-alwaysdata
|
||||
|
||||
DOMAIN_ID=$(curl -s -X GET --basic --user "${ALWAYSDATA_TOKEN} account=${ALWAYSDATA_ACCOUNT}:" ${ALWAYSDATA_API}/domain/?name=${CERTBOT_DOMAIN} | jq '.[0].id')
|
||||
|
||||
|
||||
@@ -1,11 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
KAZ_ROOT=$(cd $(dirname $0)/..; pwd)
|
||||
. "${KAZ_ROOT}/bin/.commonFunctions.sh"
|
||||
setKazVars
|
||||
|
||||
for filename in "${KAZ_KEY_DIR}/"env-*Serv "${KAZ_KEY_DIR}/"env-*DB; do
|
||||
if grep -q "^[^#=]*=\s*$" "${filename}" 2>/dev/null; then
|
||||
echo "${filename}"
|
||||
fi
|
||||
done
|
||||
@@ -1,5 +1,6 @@
|
||||
#!/bin/bash
|
||||
KAZ_ROOT=$(cd "$(dirname $0)/.."; pwd)
|
||||
|
||||
KAZ_ROOT=$(cd "$(dirname $0)"/..; pwd)
|
||||
. "${KAZ_ROOT}/bin/.commonFunctions.sh"
|
||||
PRG=$(basename $0)
|
||||
|
||||
@@ -13,14 +14,17 @@ OPTIONS
|
||||
-n|--simu SIMULATION
|
||||
-d foldername prend les envfiles dans un sous dossier /kaz/secret/foldername/ (pour les orgas !)
|
||||
Les variables seront du type foldername-envname_NOMVARIABLE=valeur
|
||||
-e varname Affiche le contenu d'une variable en particulier
|
||||
"
|
||||
}
|
||||
|
||||
|
||||
for ARG in "$@"; do
|
||||
if [ -n "${DIRECTORYARG}" ]; then # après un -d
|
||||
SUBDIRECTORY="${ARG}"
|
||||
DIRECTORYARG=
|
||||
elif [ -n "${DIRECTORYARG}" ]; then # après un -e
|
||||
VARTOECHO="${ARG}"
|
||||
ECHOVARARG=
|
||||
else
|
||||
|
||||
case "${ARG}" in
|
||||
@@ -30,6 +34,9 @@ for ARG in "$@"; do
|
||||
usage && exit ;;
|
||||
'-n' | '--simu')
|
||||
SIMU="echo" ;;
|
||||
'-e' | '--echo')
|
||||
ECHOVARARG="ON ATTEND UNE UN NOM DE VARIABLE APRES CA"
|
||||
;;
|
||||
*)
|
||||
ENVFILES="${ENVFILES} ${ARG%}";;
|
||||
esac
|
||||
@@ -56,8 +63,11 @@ for ENVFILE in $ENVFILES; do
|
||||
continue
|
||||
fi
|
||||
|
||||
|
||||
# formule magique qui crée des variables envname_NOMVARIABLE=la valeur trouvé (le sed vire les commentaires et les lignes vides)
|
||||
# on pourrait se contenter d'un "source env-file", mais avec un prefix dans les variables pour savoir ce qu'on manipule c'est bien aussi ...
|
||||
$SIMU export $(sed -e 's/#.*//' -e '/^\s*$/d' "$FILENAME" | awk -F= -v ENV="$VARNAME" '{output=output" "ENV$1"="$2} END {print output}')
|
||||
done
|
||||
|
||||
if [ -n "$VARTOECHO" ]; then
|
||||
echo ${!VARTOECHO}
|
||||
fi
|
||||
|
||||
166
bin/secretGen.sh
166
bin/secretGen.sh
@@ -8,65 +8,131 @@ cd "${KAZ_ROOT}"
|
||||
|
||||
NEW_DIR="secret"
|
||||
TMPL_DIR="secret.tmpl"
|
||||
SORTIESTANDARD=1
|
||||
DIR=$KAZ_KEY_DIR
|
||||
ORGA=
|
||||
|
||||
if [ ! -d "${NEW_DIR}/" ]; then
|
||||
rsync -a "${TMPL_DIR}/" "${NEW_DIR}/"
|
||||
fi
|
||||
|
||||
NEW_FILE="${NEW_DIR}/SetAllPass-new.sh"
|
||||
TMPL_FILE="${NEW_DIR}/SetAllPass.sh"
|
||||
usage() {
|
||||
echo "${PRG} [OPTIONS] [filename ...]
|
||||
# PARCOURE LES ENV FILE ET REMPLIT LES --clean_val-- qui n'ont pas été complétés.
|
||||
on cherche des
|
||||
@@pass@@***@@p@@ -> on génère un mot de passe 16car (les *** permettent d'identifier le mot de passe, s'il doit être utilisé ailleurs)
|
||||
@@db@@***@@d@@ -> on génère une base de données (pareil identifié par ***)
|
||||
@@user@@***@@u@@ -> on génère un user
|
||||
@@token@@***@@t@@ -> on génère un token
|
||||
@@globalvar@@***@@gv@@ -> on cherche la variable globale ***
|
||||
@@crossvar@@envname_varname@@cv@@ -> on retrouve la variable dans les envfiles
|
||||
|
||||
while read line ; do
|
||||
if [[ "${line}" =~ ^# ]] || [ -z "${line}" ] ; then
|
||||
echo "${line}"
|
||||
continue
|
||||
fi
|
||||
if [[ "${line}" =~ "--clean_val--" ]] ; then
|
||||
case "${line}" in
|
||||
*jirafeau_DATA_DIR*)
|
||||
JIRAFEAU_DIR=$(getValInFile "${DOCKERS_ENV}" "jirafeauDir")
|
||||
[ -z "${JIRAFEAU_DIR}" ] &&
|
||||
echo "${line}" ||
|
||||
sed "s%\(.*\)--clean_val--\(.*\)%\1${JIRAFEAU_DIR}\2%" <<< ${line}
|
||||
continue
|
||||
;;
|
||||
*DATABASE*|*DB_NAME*)
|
||||
dbName="$(sed "s/\([^_]*\)_.*/\1/" <<< ${line})_$(apg -n 1 -m 2 -M NCL | cut -c 1-2)"
|
||||
sed "s/\(.*\)--clean_val--\(.*\)/\1${dbName}\2/" <<< ${line}
|
||||
continue
|
||||
;;
|
||||
*ROOT_PASSWORD*|*PASSWORD*|*SECRET*)
|
||||
pass="$(apg -n 1 -m 16 -M NCL)"
|
||||
sed "s/\(.*\)--clean_val--\(.*\)/\1${pass}\2/" <<< ${line}
|
||||
continue
|
||||
;;
|
||||
*USER*)
|
||||
user="$(sed "s/\([^_]*\)_.*/\1/" <<< ${line})_$(apg -n 1 -m 2 -M NCL | cut -c 1-2)"
|
||||
sed "s/\(.*\)--clean_val--\(.*\)/\1${user}\2/" <<< ${line}
|
||||
continue
|
||||
;;
|
||||
*RAIN_LOOP*|*office_password*|*mattermost_*|*sympa_*|*gitea_*)
|
||||
pass="$(apg -n 1 -m 16 -M NCL)"
|
||||
sed "s/\(.*\)--clean_val--\(.*\)/\1${pass}\2/" <<< ${line}
|
||||
continue
|
||||
;;
|
||||
*vaultwarden_ADMIN_TOKEN*)
|
||||
pass="$(apg -n 1 -m 32 -M NCL)"
|
||||
sed "s/\(.*\)--clean_val--\(.*\)/\1${pass}\2/" <<< ${line}
|
||||
continue
|
||||
;;
|
||||
esac
|
||||
Si on précise des fichiers, alors il ne remplace que dans ceux là (et on "lie" les clean-val ensemble !!!)
|
||||
OPTIONS
|
||||
-h|--help Cette aide :-)
|
||||
-n|--simu SIMULATION
|
||||
-q|--quiet Sans bruits de fond
|
||||
-d foldername prend les envfiles dans un sous dossier /kaz/secret/orgas/foldername/ (pour les orgas !)
|
||||
-
|
||||
|
||||
"
|
||||
}
|
||||
|
||||
for ARG in "$@"; do
|
||||
if [ -n "${DIRECTORYARG}" ]; then # après un -d
|
||||
DIR=$KAZ_KEY_DIR/orgas/${ARG}
|
||||
ORGA=${ARG}
|
||||
DIRECTORYARG=
|
||||
else
|
||||
echo "${line}"
|
||||
continue
|
||||
|
||||
case "${ARG}" in
|
||||
'-d' | '--directory' | '-f' | '--folder' | '--foldername')
|
||||
DIRECTORYARG="ON ATTEND UN REPERTOIRE APRES CA" ;;
|
||||
'-h' | '--help' )
|
||||
usage && exit ;;
|
||||
'-n' | '--simu')
|
||||
SIMU="echo" ;;
|
||||
'-q' | '--quiet')
|
||||
SORTIESTANDARD="/dev/null" ;;
|
||||
*)
|
||||
ENVFILES="${ENVFILES} ${ARG%}";;
|
||||
esac
|
||||
fi
|
||||
printKazError "${line}" >&2
|
||||
done < "${TMPL_FILE}" > "${NEW_FILE}"
|
||||
done
|
||||
|
||||
mv "${NEW_FILE}" "${TMPL_FILE}"
|
||||
NB_FILES=$(echo "${ENVFILES}" | wc -w )
|
||||
|
||||
chmod a+x "${TMPL_FILE}"
|
||||
. "${TMPL_FILE}"
|
||||
"${KAZ_BIN_DIR}/updateDockerPassword.sh"
|
||||
if [[ $NB_FILES = 0 ]]; then
|
||||
ENVFILES=$(grep -lE '@@pass@@|@@db@@|@@user@@|@@token@@|@@globalvar@@|@@crossvar@@' $DIR/* | sed 's/.*\///') #
|
||||
fi
|
||||
|
||||
|
||||
|
||||
secretGen(){
|
||||
# $1 Le env-file à compléter
|
||||
|
||||
FILENAME=$DIR/$1
|
||||
|
||||
NBMATCH=$(grep -lE '@@pass@@|@@db@@|@@user@@|@@token@@|@@globalvar@@' $FILENAME | wc -l) # est ce qu'il y a des choses à génrérer
|
||||
if [[ $NBMATCH = 0 ]]; then
|
||||
true
|
||||
# rien à faire dans ce fichier, on passe
|
||||
else
|
||||
echo "Remplissage $FILENAME" >& $SORTIESTANDARD
|
||||
db="$1$(apg -n 1 -m 2 -M NCL | cut -c 1-2)"
|
||||
pass="$(apg -n 1 -m 16 -M NCL)"
|
||||
token="$(apg -n 1 -m 32 -M NCL)"
|
||||
user="$1$(apg -n 1 -m 2 -M NCL | cut -c 1-2)"
|
||||
|
||||
dbs=$(grep -Eo '@@db@@[^@]*@@d@@' $FILENAME | sed -e 's/@@db@@//' -e 's/@@d@@//')
|
||||
passwords=$(grep -Eo '@@pass@@[^@]*@@p@@' $FILENAME | sed -e 's/@@pass@@//' -e 's/@@p@@//')
|
||||
tokens=$(grep -Eo '@@token@@[^@]*@@t@@' $FILENAME | sed -e 's/@@token@@//' -e 's/@@t@@//')
|
||||
users=$(grep -Eo '@@user@@[^@]*@@u@@' $FILENAME | sed -e 's/@@user@@//' -e 's/@@u@@//')
|
||||
globalvars=$(grep -Eo '@@globalvar@@[^@]*@@gv@@' $FILENAME | sed -e 's/@@globalvar@@//' -e 's/@@gv@@//')
|
||||
|
||||
for dbName in $dbs; do sed -i "s/@@db@@$dbName@@d@@/${dbName}_$db" $DIR/*; done
|
||||
for pw in $passwords; do sed -i "s/@@pass@@$pw@@p@@/${pw}" $DIR/*; done
|
||||
for tk in $tokens; do sed -i "s/@@token@@$tk@@t@@/${tk}" $DIR/*; done
|
||||
for u in $users; do sed -i "s/@@user@@$u@@u@@/${u}_$user" $DIR/*; done
|
||||
for var in $globalvars; do sed -i "s/@@globalvar@@$var@@gv@@/${!var}" $DIR/*; done
|
||||
fi
|
||||
|
||||
}
|
||||
|
||||
|
||||
|
||||
crossVarComplete(){
|
||||
# $1 Le env-file à compléter
|
||||
|
||||
FILENAME=$DIR/$1
|
||||
|
||||
NBMATCH=$(grep -lE '@@crossvar@@' $FILENAME | wc -l) # est ce qu'il y a des cross-var à récupérer
|
||||
if [[ $NBMATCH = 0 ]]; then
|
||||
true
|
||||
# rien à faire dans ce fichier, on passe
|
||||
else
|
||||
echo "Remplissage $FILENAME" >& $SORTIESTANDARD
|
||||
|
||||
varnames=$(grep -Eo '@@crossvar@@[^@]*@@cv@@' $FILENAME | sed -e 's/@@crossvar@@//' -e 's/@@cv@@//')
|
||||
for varname in $varnames; do
|
||||
envname=${varname%_}
|
||||
value=$(/$KAZ_BIN_DIR/getPasswords.sh -e $varname $envname -d $ORGA)
|
||||
sed -i "s/@@crossvar@@$varname@@cv@@/${value}" $DIR/*;
|
||||
|
||||
done
|
||||
|
||||
fi
|
||||
|
||||
}
|
||||
|
||||
|
||||
for ENVFILE in $ENVFILES; do
|
||||
secretGen "$ENVFILE"
|
||||
done
|
||||
|
||||
|
||||
for ENVFILE in $ENVFILES; do
|
||||
crossVarComplete "$ENVFILE"
|
||||
done
|
||||
|
||||
exit 0
|
||||
|
||||
Reference in New Issue
Block a user