deploy/secrets.sh · gabriel/musehub

secrets.sh bash

144 lines 5.3 KB

sha256:a10adeeb7a0169cb9900f9806ed7a973047258abb6283724fe55e8eb68ff3f0a init: musehub initial commit Human 171 days ago

1	#!/usr/bin/env bash
2	# MuseHub secrets bootstrap — fetch from AWS SSM Parameter Store, write .env
3	#
4	# Runs on the EC2 instance BEFORE deploy.sh. Pulls every secret from SSM
5	# Parameter Store (SecureString, AES-256 at rest via KMS) and writes a fresh
6	# /opt/musehub/.env. The .env on disk is the runtime injection point for
7	# all Docker containers (--env-file).
8	#
9	# Why SSM instead of a static .env:
10	# - Secrets never travel through source control or build artifacts.
11	# - Access is audited via CloudTrail (who fetched what, when).
12	# - Rotation updates SSM; next deploy.sh run picks up the new value.
13	# - IAM role on the EC2 instance grants read access — no AWS keys on disk.
14	#
15	# SSM parameter layout (all SecureString, KMS-encrypted):
16	# /musehub/<env>/DB_PASSWORD
17	# /musehub/<env>/WEBHOOK_SECRET_KEY
18	# /musehub/<env>/RUNNER_TOKEN
19	# /musehub/<env>/R2_ACCESS_KEY_ID (if using Cloudflare R2)
20	# /musehub/<env>/R2_SECRET_ACCESS_KEY (if using Cloudflare R2)
21	#
22	# Prerequisites:
23	# - AWS CLI v2 installed on the EC2 instance
24	# - EC2 instance profile with IAM policy:
25	# ssm:GetParameter, ssm:GetParametersByPath
26	# on arn:aws:ssm:<region>:<account>:parameter/musehub/<env>/*
27	# - KMS decrypt on the CMK used for the SecureString parameters
28	#
29	# Usage:
30	# MUSEHUB_ENV=production bash deploy/secrets.sh
31	# MUSEHUB_ENV=staging bash deploy/secrets.sh
32	#
33	# After this script writes .env, run deploy.sh as usual.
34	#
35	# Fallback (no SSM / local dev):
36	# If AWS CLI is not available or SSM fetch fails, the script exits non-zero
37	# so deploy.sh does not start with stale/missing secrets. For local dev,
38	# manage .env manually — never run this script on a dev laptop.
39
40	set -euo pipefail
41
42	MUSEHUB_ENV="${MUSEHUB_ENV:-production}"
43	APP_DIR="${APP_DIR:-/opt/musehub}"
44	ENV_FILE="$APP_DIR/.env"
45	REGION="${AWS_REGION:-us-east-1}"
46	SSM_PREFIX="/musehub/${MUSEHUB_ENV}"
47
48	log() { echo "[secrets] $*"; }
49	die() { echo "[secrets] ERROR: $*" >&2; exit 1; }
50
51	# ── Preflight ─────────────────────────────────────────────────────────────────
52
53	command -v aws > /dev/null 2>&1 \|\| die "AWS CLI not installed. Install: sudo apt-get install -y awscli"
54
55	# Verify we can reach SSM (IAM role check)
56	aws ssm get-parameters-by-path \
57	--path "$SSM_PREFIX" \
58	--region "$REGION" \
59	--with-decryption \
60	--query 'Parameters[].Name' \
61	--output text > /dev/null 2>&1 \
62	\|\| die "Cannot read from SSM at $SSM_PREFIX — check the EC2 instance IAM role."
63
64	log "Fetching secrets from SSM: $SSM_PREFIX (region=$REGION)"
65
66	# ── Fetch each parameter ──────────────────────────────────────────────────────
67
68	_get() {
69	local name="$1"
70	local required="${2:-true}"
71	local value
72	value=$(aws ssm get-parameter \
73	--name "$SSM_PREFIX/$name" \
74	--region "$REGION" \
75	--with-decryption \
76	--query 'Parameter.Value' \
77	--output text 2>/dev/null) \|\| {
78	if [ "$required" = "true" ]; then
79	die "Required parameter $SSM_PREFIX/$name not found in SSM"
80	fi
81	echo ""
82	return
83	}
84	echo "$value"
85	}
86
87	DB_PASSWORD=$(_get "DB_PASSWORD")
88	WEBHOOK_SECRET_KEY=$(_get "WEBHOOK_SECRET_KEY" false)
89	RUNNER_TOKEN=$(_get "RUNNER_TOKEN" false)
90	R2_ACCESS_KEY_ID=$(_get "R2_ACCESS_KEY_ID" false)
91	R2_SECRET_ACCESS_KEY=$(_get "R2_SECRET_ACCESS_KEY" false)
92
93	# ── Write .env ────────────────────────────────────────────────────────────────
94
95	log "Writing $ENV_FILE"
96
97	# Back up the existing .env if present
98	if [ -f "$ENV_FILE" ]; then
99	cp "$ENV_FILE" "${ENV_FILE}.bak.$(date +%Y%m%d_%H%M%S)"
100	log "Previous .env backed up"
101	fi
102
103	# Write new .env — mode 600, owner musehub
104	umask 177
105	cat > "$ENV_FILE" << EOF
106	# Generated by deploy/secrets.sh at $(date -u +%Y-%m-%dT%H:%M:%SZ)
107	# Secrets sourced from AWS SSM Parameter Store: $SSM_PREFIX
108	# DO NOT edit manually — re-run secrets.sh to refresh from SSM.
109
110	MUSE_ENV=${MUSEHUB_ENV}
111	DEBUG=false
112	DB_PASSWORD=${DB_PASSWORD}
113	CORS_ORIGINS=["https://musehub.ai", "https://www.musehub.ai"]
114	EOF
115
116	if [ -n "$WEBHOOK_SECRET_KEY" ]; then
117	echo "WEBHOOK_SECRET_KEY=${WEBHOOK_SECRET_KEY}" >> "$ENV_FILE"
118	fi
119	if [ -n "$RUNNER_TOKEN" ]; then
120	echo "RUNNER_TOKEN=${RUNNER_TOKEN}" >> "$ENV_FILE"
121	fi
122	if [ -n "$R2_ACCESS_KEY_ID" ]; then
123	echo "R2_ACCESS_KEY_ID=${R2_ACCESS_KEY_ID}" >> "$ENV_FILE"
124	echo "R2_SECRET_ACCESS_KEY=${R2_SECRET_ACCESS_KEY}" >> "$ENV_FILE"
125	fi
126
127	chown musehub:musehub "$ENV_FILE" 2>/dev/null \|\| true
128	log ".env written ($(wc -l < "$ENV_FILE") lines, mode 600)"
129
130	# ── Sanity check — no weak values leaked into env ────────────────────────────
131
132	WEAK_PASSWORDS=("musehub" "changeme123" "password" "postgres" "secret" "")
133	for WEAK in "${WEAK_PASSWORDS[@]}"; do
134	if [ "$DB_PASSWORD" = "$WEAK" ]; then
135	die "DB_PASSWORD from SSM is a known weak value ($WEAK). Rotate it immediately."
136	fi
137	done
138
139	if [ ${#DB_PASSWORD} -lt 16 ]; then
140	die "DB_PASSWORD from SSM is too short (${#DB_PASSWORD} chars). Minimum is 16."
141	fi
142
143	log "Secrets sanity check passed."
144	log "Run 'bash deploy/deploy.sh' to deploy."

File History 1 commit

sha256:a10adeeb7a0169cb9900f9806ed7a973047258abb6283724fe55e8eb68ff3f0a init: musehub initial commit Human 171 days ago