nexarch/deploy/rollout-131-provision-secrets.sh

#!/usr/bin/env bash
# Einrichtungsskript fuer die verbleibenden Secret-Werte des 131-Rollouts.
# Fuehrt selbst KEIN systemctl aus -- nur DB-Rolle/DB anlegen und die
# KEK-Client-Registrierung gegen die Core-Registry-DB ausfuehren.
#
# Nutzung (als root auf 131, im Repo-Checkout, z.B. /root/nexarch-code):
#   ./deploy/rollout-131-provision-secrets.sh
#
# Voraussetzung: /etc/nexarch/connect-app.env und /etc/nexarch/dms-app.env
# existieren bereits (aus rollout-131-sync.sh).
set -euo pipefail

CONNECT_ENV=/etc/nexarch/connect-app.env
DMS_ENV=/etc/nexarch/dms-app.env
CORE_ENV=/etc/nexarch/core.env

if [ ! -f "$CONNECT_ENV" ] || [ ! -f "$DMS_ENV" ] || [ ! -f "$CORE_ENV" ]; then
	echo "Abbruch: eine der Env-Dateien fehlt ($CONNECT_ENV, $DMS_ENV, $CORE_ENV)." >&2
	exit 1
fi

echo "== 1. Connect-DB (Rolle + Datenbank) =="
if grep -q '^NEXARCH_CONNECT_APP_TENANT_DSN=.*TODO' "$CONNECT_ENV" 2>/dev/null || ! grep -q '^NEXARCH_CONNECT_APP_TENANT_DSN=' "$CONNECT_ENV"; then
	PW=$(openssl rand -hex 20)
	sudo -u postgres psql -v ON_ERROR_STOP=1 <<SQL
DO \$\$
BEGIN
	IF EXISTS (SELECT FROM pg_roles WHERE rolname = 'connect_app') THEN
		ALTER ROLE connect_app WITH PASSWORD '${PW}';
	ELSE
		CREATE ROLE connect_app LOGIN PASSWORD '${PW}';
	END IF;
END
\$\$;
SELECT 'CREATE DATABASE connect_app_tenant OWNER connect_app'
WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'connect_app_tenant')\gexec
SQL
	sed -i '/^NEXARCH_CONNECT_APP_TENANT_DSN=/d' "$CONNECT_ENV"
	echo "NEXARCH_CONNECT_APP_TENANT_DSN=postgresql://connect_app:${PW}@localhost:5432/connect_app_tenant?sslmode=disable" >> "$CONNECT_ENV"
	echo "OK: NEXARCH_CONNECT_APP_TENANT_DSN gesetzt."
else
	echo "Uebersprungen: NEXARCH_CONNECT_APP_TENANT_DSN ist schon gesetzt."
fi

if grep -q '^NEXARCH_CONNECT_APP_LISTEN_ADDR=.*TODO' "$CONNECT_ENV" 2>/dev/null || ! grep -q '^NEXARCH_CONNECT_APP_LISTEN_ADDR=' "$CONNECT_ENV"; then
	sed -i '/^NEXARCH_CONNECT_APP_LISTEN_ADDR=/d' "$CONNECT_ENV"
	echo "NEXARCH_CONNECT_APP_LISTEN_ADDR=127.0.0.1:9500" >> "$CONNECT_ENV"
	echo "OK: NEXARCH_CONNECT_APP_LISTEN_ADDR gesetzt (127.0.0.1:9500)."
else
	echo "Uebersprungen: NEXARCH_CONNECT_APP_LISTEN_ADDR ist schon gesetzt."
fi

echo
echo "== 2. KEK-Client fuer DMS registrieren =="
if grep -q '^NEXARCH_DMS_APP_KEK_CLIENT_ID=.*TODO' "$DMS_ENV" 2>/dev/null; then
	REGISTRY_DSN=$(grep '^NEXARCH_REGISTRY_DSN=' "$CORE_ENV" | cut -d= -f2-)
	if [ -z "$REGISTRY_DSN" ]; then
		echo "Abbruch: NEXARCH_REGISTRY_DSN nicht in $CORE_ENV gefunden." >&2
		exit 1
	fi
	REPO_ROOT=$(cd "$(dirname "$0")/.." && pwd)
	PROVISION_DIR="$REPO_ROOT/cmd/provision-dms-kek"
	mkdir -p "$PROVISION_DIR"
	cat > "$PROVISION_DIR/main.go" <<'EOF'
package main

import (
	"bufio"
	"context"
	"fmt"
	"os"
	"strings"

	"github.com/jackc/pgx/v5/pgxpool"
	"gitea.perlbach24.de/scripte/nexarch/internal/moduleregistry"
)

const envFile = "/etc/nexarch/dms-app.env"

func main() {
	pool, err := pgxpool.New(context.Background(), os.Getenv("CORE_ADMIN_DSN"))
	if err != nil {
		panic(err)
	}
	defer pool.Close()
	reg := moduleregistry.NewRegistry(pool, nil)
	if _, err := reg.Get(context.Background(), "dms"); err != nil {
		if _, err := reg.Register(context.Background(), "dms", "1", nil); err != nil {
			panic(err)
		}
	}
	clientID, secret, err := reg.Provision(context.Background(), "dms")
	if err != nil {
		panic(err)
	}

	raw, err := os.ReadFile(envFile)
	if err != nil {
		panic(err)
	}
	var kept []string
	sc := bufio.NewScanner(strings.NewReader(string(raw)))
	for sc.Scan() {
		line := sc.Text()
		if strings.HasPrefix(line, "NEXARCH_DMS_APP_KEK_CLIENT_ID=") || strings.HasPrefix(line, "NEXARCH_DMS_APP_KEK_CLIENT_SECRET=") {
			continue
		}
		kept = append(kept, line)
	}
	kept = append(kept, "NEXARCH_DMS_APP_KEK_CLIENT_ID="+clientID)
	kept = append(kept, "NEXARCH_DMS_APP_KEK_CLIENT_SECRET="+secret)
	if err := os.WriteFile(envFile, []byte(strings.Join(kept, "\n")+"\n"), 0600); err != nil {
		panic(err)
	}
	fmt.Println("OK: KEK-Client-ID/-Secret geschrieben.")
}
EOF
	(cd "$REPO_ROOT" && CORE_ADMIN_DSN="$REGISTRY_DSN" go run ./cmd/provision-dms-kek)
	rm -rf "$PROVISION_DIR"
else
	echo "Uebersprungen: NEXARCH_DMS_APP_KEK_CLIENT_ID ist schon gesetzt."
fi

echo
echo "== 3. Core-Service-Token fuer DMS (INT-14) =="
if grep -q '^NEXARCH_DMS_APP_CORE_SERVICE_TOKEN=.*TODO' "$DMS_ENV" 2>/dev/null; then
	echo "OFFEN: kein passender Core-Endpunkt vorhanden (echte Code-Luecke, kein Konfigurationsproblem)."
	echo "       DMS ruft GET /tenants/{slug} mit X-Service-Token auf, Core registriert diese Route nirgends."
	echo "       Muss erst durch ein eigenes Ticket (Core-seitiger Endpunkt) geschlossen werden."
else
	echo "Uebersprungen: NEXARCH_DMS_APP_CORE_SERVICE_TOKEN ist schon gesetzt."
fi

echo
echo "== Zusammenfassung =="
grep -c TODO "$CONNECT_ENV" | xargs -I{} echo "connect-app.env: {} offene TODOs"
grep -c TODO "$DMS_ENV" | xargs -I{} echo "dms-app.env: {} offene TODOs"