tools/set-secret.sh (1014 bytes)
1 #!/usr/bin/env bash 2 # Put one secret into .env (or into FILE) without it touching shell history, 3 # the process list or the screen. 4 # 5 # tools/set-secret.sh SUBPLZ_WEB_STRIPE_SECRET_KEY 6 # tools/set-secret.sh DIGITALOCEAN_TOKEN /etc/subplz-burst.env 7 set -euo pipefail 8 9 key="${1:?usage: set-secret.sh VARIABLE_NAME [FILE]}" 10 root="$(cd "$(dirname "$0")/.." && pwd)" 11 env_file="${2:-$root/.env}" 12 13 read -r -s -p "Value for $key (input hidden): " value 14 echo 15 [ -n "$value" ] || { echo "Empty value - nothing changed." >&2; exit 1; } 16 17 touch "$env_file" 18 tmp="$(mktemp)" 19 grep -v "^${key}=" "$env_file" > "$tmp" || true 20 printf '%s=%s\n' "$key" "$value" >> "$tmp" 21 cat "$tmp" > "$env_file" 22 rm -f "$tmp" 23 24 # The service does not run as root; keep .env readable by whoever owns the 25 # checkout, and by nobody else. Another FILE stays with root. 26 if [ -z "${2:-}" ]; then 27 chown "$(stat -c %U:%G "$root")" "$env_file" 2>/dev/null || true 28 fi 29 chmod 600 "$env_file" 30 31 echo "$key saved in $env_file. Restart the services that read it."