69 lines
2.4 KiB
Bash
69 lines
2.4 KiB
Bash
#!/usr/bin/env sh
|
|
set -eu
|
|
|
|
cd "$(dirname "$0")"
|
|
umask 077
|
|
mkdir -p secrets
|
|
|
|
validate_tenant() {
|
|
: "${STANDALONE_TENANT_ID:?Set STANDALONE_TENANT_ID to the platform organization ID before setup}"
|
|
if ! printf '%s\n' "$STANDALONE_TENANT_ID" | LC_ALL=C grep -Eq '^[0-9A-HJKMNP-TV-Z]{26}$'; then
|
|
echo 'STANDALONE_TENANT_ID must be a 26-character ULID' >&2
|
|
exit 1
|
|
fi
|
|
if [ "$STANDALONE_TENANT_ID" = '01J00000000000000000000000' ]; then
|
|
echo 'The development placeholder cannot be used for a pilot organization' >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
if [ ! -f .env ]; then
|
|
validate_tenant
|
|
migration_password="$(openssl rand -hex 32)"
|
|
app_password="$(openssl rand -hex 32)"
|
|
manager_token="$(openssl rand -hex 32)"
|
|
terminal_token="$(openssl rand -hex 32)"
|
|
pfx_passphrase="$(openssl rand -hex 32)"
|
|
{
|
|
printf 'POSTGRES_MIGRATION_PASSWORD=%s\n' "$migration_password"
|
|
printf 'POSTGRES_APP_PASSWORD=%s\n' "$app_password"
|
|
printf 'STANDALONE_MANAGER_TOKEN=%s\n' "$manager_token"
|
|
printf 'STANDALONE_TERMINAL_TOKEN=%s\n' "$terminal_token"
|
|
printf 'HTTPS_PFX_PASSPHRASE=%s\n' "$pfx_passphrase"
|
|
printf 'STANDALONE_TENANT_ID=%s\n' "$STANDALONE_TENANT_ID"
|
|
printf 'STANDALONE_ACTOR_ID=01J00000000000000000000001\n'
|
|
printf 'STANDALONE_TERMINAL_ACTOR_ID=01J00000000000000000000002\n'
|
|
} > .env
|
|
printf '%s\n' "$manager_token" > secrets/manager.token
|
|
printf '%s\n' "$terminal_token" > secrets/terminal.token
|
|
fi
|
|
|
|
. ./.env
|
|
validate_tenant
|
|
|
|
if ! grep -q '^VAPID_PUBLIC_KEY=' .env; then
|
|
docker run --rm \
|
|
-v "$(cd ../.. && pwd):/app:ro" \
|
|
-w /app \
|
|
node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 \
|
|
node scripts/generate-vapid-keys.mjs >> .env
|
|
fi
|
|
|
|
. ./.env
|
|
validate_tenant
|
|
if [ ! -f secrets/staff.pfx ]; then
|
|
openssl req -x509 -newkey rsa:3072 -sha256 -days 365 -nodes \
|
|
-keyout secrets/staff.key -out secrets/staff.crt \
|
|
-subj '/CN=192.168.1.81' \
|
|
-addext 'subjectAltName=IP:192.168.1.81' \
|
|
-addext 'keyUsage=digitalSignature,keyEncipherment' \
|
|
-addext 'extendedKeyUsage=serverAuth'
|
|
openssl pkcs12 -export -out secrets/staff.pfx \
|
|
-inkey secrets/staff.key -in secrets/staff.crt \
|
|
-passout "pass:${HTTPS_PFX_PASSPHRASE}"
|
|
fi
|
|
|
|
openssl x509 -in secrets/staff.crt -outform DER | sha256sum | cut -d ' ' -f 1 > secrets/certificate.sha256
|
|
chmod 600 .env secrets/*
|
|
docker compose --env-file .env config >/dev/null
|
|
docker compose --env-file .env up -d --build
|