2b8f6f5b3b
Introduce a Resolver that owns env lookup and typed parsing for probod-bootstrap. Env values prefixed with aws://<secret-id> are fetched from AWS Secrets Manager (plaintext SecretString); each secret ID is cached per run. Builder now takes a Resolver only. Prefix every probod-bootstrap input with PROBOD_ so bootstrap config does not collide with unrelated process environment (for example AWS_* used by other tooling). Secrets Manager authentication uses the standard AWS SDK default chain (AWS_REGION, IAM role, profile); PROBOD_AWS_* vars configure S3 in the generated config only. Update Helm deployment env names, GNUmakefile dev-config, Lima provision, e2e testutil, compose.prod.yaml, and docs. Deployments must rename bootstrap env vars to PROBOD_* (e.g. AUTH_COOKIE_SECRET → PROBOD_AUTH_COOKIE_SECRET). BREAKING CHANGE: all env vars are now prefixed by `PROBOD_`. Signed-off-by: Ludovic Vielle <ludovic@probo.com>
24 lines
910 B
Bash
24 lines
910 B
Bash
#!/bin/bash
|
|
set -e
|
|
|
|
# Configuration file path
|
|
CONFIG_FILE="${CONFIG_FILE:-/etc/probod/config.yml}"
|
|
|
|
# If bootstrap env vars are set, always (re)generate the config from them.
|
|
# This includes literal values and aws:// Secrets Manager references.
|
|
# This ensures that updated env vars take effect even when a stale config
|
|
# file exists on a persistent volume. When no env vars are present, fall
|
|
# back to an existing config file (e.g., mounted from a ConfigMap).
|
|
if [ -n "$PROBOD_ENCRYPTION_KEY" ]; then
|
|
echo "Generating configuration file from environment variables at: $CONFIG_FILE"
|
|
probod-bootstrap -output "$CONFIG_FILE"
|
|
elif [ -f "$CONFIG_FILE" ]; then
|
|
echo "Using existing configuration file at: $CONFIG_FILE"
|
|
else
|
|
echo "Error: no bootstrap env vars set and no config file found at $CONFIG_FILE" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Execute probod with the generated config
|
|
exec probod -cfg-file "$CONFIG_FILE" "$@"
|