init: 아르고cd, vault 기반 인프라 설계

2026-07-24 14:31:09 +09:00
parent 8879d0a3fe
commit d507ac6ee9
137 changed files with 11431 additions and 1 deletions
@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if ! command -v vault >/dev/null 2>&1; then
+  echo "vault CLI is required" >&2
+  exit 1
+fi
+
+prompt_secret() {
+  local var_name="$1"
+  local label="$2"
+  local value=""
+  local confirm=""
+
+  while true; do
+    read -r -s -p "${label}: " value
+    echo
+    read -r -s -p "${label} (confirm): " confirm
+    echo
+
+    if [[ "$value" != "$confirm" ]]; then
+      echo "Values did not match. Try again." >&2
+      continue
+    fi
+
+    if [[ -z "$value" ]]; then
+      echo "Value must not be empty." >&2
+      continue
+    fi
+
+    printf -v "$var_name" '%s' "$value"
+    break
+  done
+}
+
+prompt_value() {
+  local var_name="$1"
+  local label="$2"
+  local default_value="${3:-}"
+  local value=""
+
+  if [[ -n "$default_value" ]]; then
+    read -r -p "${label} [${default_value}]: " value
+    value="${value:-$default_value}"
+  else
+    read -r -p "${label}: " value
+  fi
+
+  if [[ -z "$value" ]]; then
+    echo "Value must not be empty." >&2
+    exit 1
+  fi
+
+  printf -v "$var_name" '%s' "$value"
+}
+
+echo "Populate provider Vault workload seeds"
+echo "VAULT_ADDR=${VAULT_ADDR:-unset}"
+echo "This script prompts securely so values are not exposed in shell history."
+echo "The workload workflow AppRole bootstrap path is managed by Terraform."
+echo
+
+prompt_secret PLATFORM_POSTGRES_SUPERUSER_PASSWORD "Platform Postgres superuser password"
+prompt_value AUTH_SERVER_DATASOURCE_USERNAME "Postgres auth-server username" "project_auth"
+prompt_secret AUTH_SERVER_DATASOURCE_PASSWORD "Postgres auth-server password"
+prompt_secret PLATFORM_KEYCLOAK_DB_PASSWORD "Postgres keycloak password"
+prompt_secret PLATFORM_KEYCLOAK_BOOTSTRAP_ADMIN_PASSWORD "Platform Keycloak bootstrap admin password"
+prompt_secret AUTH_SERVER_KEYCLOAK_CLIENT_SECRET "Keycloak auth-server client secret"
+
+vault kv put kv/dev/workload/platform/postgres/superuser \
+  POSTGRES_SUPERUSER_PASSWORD="$PLATFORM_POSTGRES_SUPERUSER_PASSWORD" >/dev/null
+
+vault kv put kv/dev/workload/platform/postgres/auth-server \
+  APP_DATASOURCE_USERNAME="$AUTH_SERVER_DATASOURCE_USERNAME" \
+  APP_DATASOURCE_PASSWORD="$AUTH_SERVER_DATASOURCE_PASSWORD" \
+  AUTH_DB_PASSWORD="$AUTH_SERVER_DATASOURCE_PASSWORD" >/dev/null
+
+vault kv put kv/dev/workload/platform/postgres/keycloak \
+  KEYCLOAK_DB_PASSWORD="$PLATFORM_KEYCLOAK_DB_PASSWORD" >/dev/null
+
+vault kv put kv/dev/workload/platform/keycloak/bootstrap-admin \
+  KC_BOOTSTRAP_ADMIN_PASSWORD="$PLATFORM_KEYCLOAK_BOOTSTRAP_ADMIN_PASSWORD" >/dev/null
+
+vault kv put kv/dev/workload/platform/keycloak/client-auth-server \
+  APP_SECURITY_OAUTH2_KEYCLOAK_CLIENT_SECRET="$AUTH_SERVER_KEYCLOAK_CLIENT_SECRET" \
+  KEYCLOAK_CLIENT_SECRET="$AUTH_SERVER_KEYCLOAK_CLIENT_SECRET" >/dev/null
+
+echo
+echo "Provider Vault workload seed values updated."