deploy: add single-host cloud profile

2026-08-26 09:00:07 +08:00
parent 43239d38f9
commit 7b32b479f5
7 changed files with 290 additions and 0 deletions
@@ -0,0 +1,46 @@
+#!/usr/bin/env sh
+set -eu
+
+if [ "$#" -ne 4 ]; then
+  echo "usage: $0 PUBLIC_ORIGIN VERSION COMMIT BUILD_TIME" >&2
+  exit 2
+fi
+
+public_origin=$1
+build_version=$2
+build_commit=$3
+build_time=$4
+public_host=${public_origin#http://}
+public_host=${public_host#https://}
+output_path=$(dirname "$0")/.env
+
+if [ -e "$output_path" ]; then
+  echo "refusing to overwrite existing $output_path" >&2
+  exit 1
+fi
+
+umask 077
+{
+  printf 'PUBLIC_ORIGIN=%s\n' "$public_origin"
+  printf 'PUBLIC_HOST=%s\n' "$public_host"
+  printf 'PLATFORM_BUILD_VERSION=%s\n' "$build_version"
+  printf 'PLATFORM_BUILD_COMMIT=%s\n' "$build_commit"
+  printf 'PLATFORM_BUILD_TIME=%s\n' "$build_time"
+  printf 'POSTGRES_PASSWORD=%s\n' "$(openssl rand -hex 24)"
+  printf 'REDIS_PASSWORD=%s\n' "$(openssl rand -hex 24)"
+  printf 'MINIO_ACCESS_KEY=%s\n' "$(openssl rand -hex 12)"
+  printf 'MINIO_SECRET_KEY=%s\n' "$(openssl rand -hex 32)"
+  printf 'KEYCLOAK_ADMIN_USERNAME=platform-admin\n'
+  printf 'KEYCLOAK_ADMIN_PASSWORD=%s\n' "$(openssl rand -hex 24)"
+  printf 'DEVICE_LOCAL_SECRET=%s\n' "$(openssl rand -hex 32)"
+  printf 'RTC_TOKEN_SIGNING_SECRET=%s\n' "$(openssl rand -hex 32)"
+  printf 'CURSOR_SIGNING_SECRET=%s\n' "$(openssl rand -hex 32)"
+  printf 'SHARE_TOKEN_SIGNING_SECRET=%s\n' "$(openssl rand -hex 32)"
+  printf 'PROVIDER_CALLBACK_SECRET=%s\n' "$(openssl rand -hex 32)"
+  printf 'MOCK_PROVIDER_API_KEY=%s\n' "$(openssl rand -hex 24)"
+  printf 'ALERT_WEBHOOK_SECRET=%s\n' "$(openssl rand -hex 32)"
+} > "$output_path"
+
+chmod 600 "$output_path"
+echo "created $output_path with mode 600"
+