story/deploy/server/bootstrap-secrets.sh

#!/usr/bin/env sh
set -eu

if [ "$#" -ne 4 ]; then
  echo "usage: $0 PUBLIC_ORIGIN VERSION COMMIT BUILD_TIME" >&2
  exit 2
fi

public_origin=$1
build_version=$2
build_commit=$3
build_time=$4
public_host=${public_origin#http://}
public_host=${public_host#https://}
output_path=$(dirname "$0")/.env

if [ -e "$output_path" ]; then
  echo "refusing to overwrite existing $output_path" >&2
  exit 1
fi

umask 077
{
  printf 'PUBLIC_ORIGIN=%s\n' "$public_origin"
  printf 'PUBLIC_HOST=%s\n' "$public_host"
  printf 'PLATFORM_BUILD_VERSION=%s\n' "$build_version"
  printf 'PLATFORM_BUILD_COMMIT=%s\n' "$build_commit"
  printf 'PLATFORM_BUILD_TIME=%s\n' "$build_time"
  printf 'POSTGRES_PASSWORD=%s\n' "$(openssl rand -hex 24)"
  printf 'REDIS_PASSWORD=%s\n' "$(openssl rand -hex 24)"
  printf 'MINIO_ACCESS_KEY=%s\n' "$(openssl rand -hex 12)"
  printf 'MINIO_SECRET_KEY=%s\n' "$(openssl rand -hex 32)"
  printf 'KEYCLOAK_ADMIN_USERNAME=platform-admin\n'
  printf 'KEYCLOAK_ADMIN_PASSWORD=%s\n' "$(openssl rand -hex 24)"
  printf 'DEVICE_LOCAL_SECRET=%s\n' "$(openssl rand -hex 32)"
  printf 'DEVICE_CREDENTIAL_MASTER_KEY=%s\n' "$(openssl rand -hex 32)"
  printf 'RTC_TOKEN_SIGNING_SECRET=%s\n' "$(openssl rand -hex 32)"
  printf 'CURSOR_SIGNING_SECRET=%s\n' "$(openssl rand -hex 32)"
  printf 'SHARE_TOKEN_SIGNING_SECRET=%s\n' "$(openssl rand -hex 32)"
  printf 'MEMORY_TOOL_SIGNING_SECRET=%s\n' "$(openssl rand -hex 32)"
  printf 'PROVIDER_CALLBACK_SECRET=%s\n' "$(openssl rand -hex 32)"
  printf 'PLATFORM_HEALTH_CALLBACK_SECRET=%s\n' "$(openssl rand -hex 32)"
  printf 'MOCK_PROVIDER_API_KEY=%s\n' "$(openssl rand -hex 24)"
  printf 'ALERT_WEBHOOK_SECRET=%s\n' "$(openssl rand -hex 32)"
} > "$output_path"

chmod 600 "$output_path"
echo "created $output_path with mode 600"