mirror of
https://origin.cursor.com/mrdevmx/panels.git
synced 2026-10-09 14:53:18 +00:00
1ac04996b6
Scripts create-accesses / verify-connectivity para un Postgres+Redis+bucket por ambiente. /v1/health y el arranque de la API incluyen sonda de storage. Co-authored-by: alberto.martinez <alberto.martinez@mrdev.mx>
131 lines
5.1 KiB
Bash
Executable file
131 lines
5.1 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# PANELS · genera secretos de UN ambiente y, si hay superusuario, crea
|
|
# roles/bases/ACLs. No crea el servidor Postgres, Redis ni el bucket:
|
|
# esos se levantan en Coolify / Contabo; este script solo deja los accesos.
|
|
#
|
|
# Uso (solo imprimir bloque .env, sin tocar servidores):
|
|
# PGHOST=pg.interno REDIS_HOST=redis.interno S3_BUCKET=panels-prod \
|
|
# ./db/provision/create-accesses.sh
|
|
#
|
|
# Uso (crear roles en un Postgres/Redis ya levantados):
|
|
# PGHOST=... PGUSER=postgres PGPASSWORD=... REDIS_ADMIN_URL=redis://:...@host:6379 \
|
|
# ./db/provision/create-accesses.sh --apply --verify
|
|
#
|
|
# Flags:
|
|
# --apply corre 01-04 SQL + 05 Redis ACL con las claves generadas
|
|
# --verify corre verify-connectivity.sh al final (implica tener URLs)
|
|
# --out FILE escribe el bloque .env (FILE debe estar gitignored, ej. .env.prod.local)
|
|
set -euo pipefail
|
|
HERE="$(cd "$(dirname "$0")" && pwd)"
|
|
APPLY=0
|
|
VERIFY=0
|
|
OUT=""
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
--apply) APPLY=1; shift ;;
|
|
--verify) VERIFY=1; shift ;;
|
|
--out) OUT="$2"; shift 2 ;;
|
|
-h|--help) sed -n '2,20p' "$0"; exit 0 ;;
|
|
*) echo "Flag desconocido: $1" >&2; exit 1 ;;
|
|
esac
|
|
done
|
|
|
|
rand24() { openssl rand -hex 24; }
|
|
rand32() { openssl rand -hex 32; }
|
|
|
|
PGHOST="${PGHOST:-127.0.0.1}"
|
|
PGPORT="${PGPORT:-5432}"
|
|
REDIS_HOST="${REDIS_HOST:-127.0.0.1}"
|
|
REDIS_PORT="${REDIS_PORT:-6379}"
|
|
PGUSER="${PGUSER:-postgres}"
|
|
|
|
PLATFORM_OWNER_PASSWORD="${PLATFORM_OWNER_PASSWORD:-$(rand24)}"
|
|
PLATFORM_APP_PASSWORD="${PLATFORM_APP_PASSWORD:-$(rand24)}"
|
|
IAM_OWNER_PASSWORD="${IAM_OWNER_PASSWORD:-$(rand24)}"
|
|
IAM_APP_PASSWORD="${IAM_APP_PASSWORD:-$(rand24)}"
|
|
CORE_OWNER_PASSWORD="${CORE_OWNER_PASSWORD:-$(rand24)}"
|
|
CORE_APP_PASSWORD="${CORE_APP_PASSWORD:-$(rand24)}"
|
|
IAM_REDIS_PASSWORD="${IAM_REDIS_PASSWORD:-$(rand24)}"
|
|
CORE_REDIS_PASSWORD="${CORE_REDIS_PASSWORD:-$(rand24)}"
|
|
SESSION_SECRET="${SESSION_SECRET:-$(rand32)}"
|
|
DOCS_KEY="${DOCS_KEY:-$(rand32)}"
|
|
|
|
block() {
|
|
cat <<EOF
|
|
# PANELS · secretos de un solo ambiente (no mezclar prod/staging/dev)
|
|
SESSION_SECRET=${SESSION_SECRET}
|
|
DOCS_KEY=${DOCS_KEY}
|
|
|
|
DATABASE_URL_PLATFORM=postgresql://panels_platform_app:${PLATFORM_APP_PASSWORD}@${PGHOST}:${PGPORT}/panels_platform
|
|
DATABASE_URL_PLATFORM_OWNER=postgresql://panels_platform_owner:${PLATFORM_OWNER_PASSWORD}@${PGHOST}:${PGPORT}/panels_platform
|
|
DATABASE_URL_IAM=postgresql://panels_iam_app:${IAM_APP_PASSWORD}@${PGHOST}:${PGPORT}/panels_product
|
|
DATABASE_URL_IAM_OWNER=postgresql://panels_iam_owner:${IAM_OWNER_PASSWORD}@${PGHOST}:${PGPORT}/panels_product
|
|
DATABASE_URL_CORE=postgresql://panels_core_app:${CORE_APP_PASSWORD}@${PGHOST}:${PGPORT}/panels_product
|
|
DATABASE_URL_CORE_OWNER=postgresql://panels_core_owner:${CORE_OWNER_PASSWORD}@${PGHOST}:${PGPORT}/panels_product
|
|
|
|
REDIS_URL_IAM=redis://panels_iam_redis:${IAM_REDIS_PASSWORD}@${REDIS_HOST}:${REDIS_PORT}
|
|
REDIS_URL_CORE=redis://panels_core_redis:${CORE_REDIS_PASSWORD}@${REDIS_HOST}:${REDIS_PORT}
|
|
|
|
# Contabo -- rellenar endpoint/keys del Object Storage de ESTE ambiente
|
|
S3_ENDPOINT=${S3_ENDPOINT:-}
|
|
S3_BUCKET=${S3_BUCKET:-}
|
|
S3_REGION=${S3_REGION:-usc1}
|
|
S3_ACCESS_KEY_ID=${S3_ACCESS_KEY_ID:-}
|
|
S3_SECRET_ACCESS_KEY=${S3_SECRET_ACCESS_KEY:-}
|
|
|
|
# Passwords sueltos (provision / compose local)
|
|
POSTGRES_SUPERUSER_PASSWORD=${PGPASSWORD:-}
|
|
PLATFORM_OWNER_PASSWORD=${PLATFORM_OWNER_PASSWORD}
|
|
PLATFORM_APP_PASSWORD=${PLATFORM_APP_PASSWORD}
|
|
IAM_OWNER_PASSWORD=${IAM_OWNER_PASSWORD}
|
|
IAM_APP_PASSWORD=${IAM_APP_PASSWORD}
|
|
CORE_OWNER_PASSWORD=${CORE_OWNER_PASSWORD}
|
|
CORE_APP_PASSWORD=${CORE_APP_PASSWORD}
|
|
IAM_REDIS_PASSWORD=${IAM_REDIS_PASSWORD}
|
|
CORE_REDIS_PASSWORD=${CORE_REDIS_PASSWORD}
|
|
EOF
|
|
}
|
|
|
|
if [[ "$APPLY" == "1" ]]; then
|
|
: "${PGPASSWORD:?PGPASSWORD del superusuario es obligatorio con --apply}"
|
|
SUPERUSER_URL="postgresql://${PGUSER}:${PGPASSWORD}@${PGHOST}:${PGPORT}/postgres"
|
|
echo "== Aplicando roles/bases/esquemas en ${PGHOST}:${PGPORT} =="
|
|
psql "$SUPERUSER_URL" \
|
|
-v platform_owner_pw="$PLATFORM_OWNER_PASSWORD" -v platform_app_pw="$PLATFORM_APP_PASSWORD" \
|
|
-v iam_owner_pw="$IAM_OWNER_PASSWORD" -v iam_app_pw="$IAM_APP_PASSWORD" \
|
|
-v core_owner_pw="$CORE_OWNER_PASSWORD" -v core_app_pw="$CORE_APP_PASSWORD" \
|
|
-f "$HERE/01-roles.sql"
|
|
psql "$SUPERUSER_URL" -f "$HERE/02-databases.sql"
|
|
psql "postgresql://${PGUSER}:${PGPASSWORD}@${PGHOST}:${PGPORT}/panels_platform" -f "$HERE/03-platform-database.sql"
|
|
psql "postgresql://${PGUSER}:${PGPASSWORD}@${PGHOST}:${PGPORT}/panels_product" -f "$HERE/04-product-database.sql"
|
|
if [[ -n "${REDIS_ADMIN_URL:-}" ]]; then
|
|
echo "== Aplicando ACLs Redis =="
|
|
REDIS_ADMIN_URL="$REDIS_ADMIN_URL" \
|
|
IAM_REDIS_PASSWORD="$IAM_REDIS_PASSWORD" \
|
|
CORE_REDIS_PASSWORD="$CORE_REDIS_PASSWORD" \
|
|
"$HERE/05-redis-acl.sh"
|
|
else
|
|
echo "SKIP - REDIS_ADMIN_URL no definido; no se crearon usuarios ACL"
|
|
fi
|
|
fi
|
|
|
|
ENV_TEXT="$(block)"
|
|
echo "$ENV_TEXT"
|
|
if [[ -n "$OUT" ]]; then
|
|
umask 077
|
|
printf '%s\n' "$ENV_TEXT" > "$OUT"
|
|
echo "Escrito $OUT (permisos 600). No lo subas a git." >&2
|
|
fi
|
|
|
|
if [[ "$VERIFY" == "1" ]]; then
|
|
echo "== Verificando conectividad ==" >&2
|
|
tmp="$(mktemp)"
|
|
umask 077
|
|
printf '%s\n' "$ENV_TEXT" > "$tmp"
|
|
set -a
|
|
# shellcheck disable=SC1090
|
|
source "$tmp"
|
|
set +a
|
|
rm -f "$tmp"
|
|
"$HERE/verify-connectivity.sh"
|
|
fi
|