04852fc480
Some checks failed
API Endpoint Tests / test-api-endpoints (push) Successful in 19s
Blockchain Synchronization Verification / sync-verification (push) Failing after 2s
Integration Tests / test-service-integration (push) Successful in 3m1s
Multi-Node Blockchain Health Monitoring / health-check (push) Failing after 7s
P2P Network Verification / p2p-verification (push) Successful in 9s
Python Tests / test-python (push) Successful in 28s
Security Scanning / security-scan (push) Successful in 55s
Systemd Sync / sync-systemd (push) Successful in 17s
Remove default fallback for API_KEY_HASH_SECRET in tenant context middleware and management service, requiring explicit environment variable configuration. Migrate keystore password handling from /etc/aitbc/keystore_password to /etc/aitbc/credentials/keystore_password with 600 permissions. Add load-keystore-secrets.sh pre-start hook and /run/aitbc/secrets/.env environment file to blockchain-node, blockchain
38 lines
1.1 KiB
Bash
Executable File
38 lines
1.1 KiB
Bash
Executable File
#!/bin/bash
|
|
# Load AITBC secrets from credentials directory
|
|
# This script is called by systemd services before main process starts
|
|
|
|
set -e
|
|
|
|
CREDENTIALS_DIR="/etc/aitbc/credentials"
|
|
RUN_DIR="/run/aitbc/secrets"
|
|
|
|
# Create runtime directory (tmpfs, cleared on reboot)
|
|
mkdir -p "$RUN_DIR"
|
|
chmod 700 "$RUN_DIR"
|
|
|
|
# Create .env file from credentials
|
|
ENV_FILE="$RUN_DIR/.env"
|
|
|
|
if [ -f "$CREDENTIALS_DIR/api_hash_secret" ]; then
|
|
echo "API_KEY_HASH_SECRET=$(cat $CREDENTIALS_DIR/api_hash_secret)" >> "$ENV_FILE"
|
|
fi
|
|
|
|
if [ -f "$CREDENTIALS_DIR/proposer_id" ]; then
|
|
echo "proposer_id=$(cat $CREDENTIALS_DIR/proposer_id)" >> "$ENV_FILE"
|
|
fi
|
|
|
|
if [ -f "$CREDENTIALS_DIR/keystore_password" ]; then
|
|
echo "KEYSTORE_PASSWORD=$(cat $CREDENTIALS_DIR/keystore_password)" >> "$ENV_FILE"
|
|
fi
|
|
|
|
# Add non-sensitive config from main .env
|
|
if [ -f "/etc/aitbc/.env" ]; then
|
|
# Skip lines that are comments or contain migrated secrets
|
|
grep -v '^#' /etc/aitbc/.env | grep -v 'API_KEY_HASH_SECRET' | grep -v 'proposer_id' >> "$ENV_FILE" || true
|
|
fi
|
|
|
|
chmod 600 "$ENV_FILE"
|
|
|
|
echo "Secrets loaded to $ENV_FILE"
|