82 lines
2.3 KiB
Bash
Executable File
82 lines
2.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Generate a secure .env file from .env.example with random secrets.
|
|
# Usage: bash scripts/generate-env.sh [output-path]
|
|
#
|
|
# If output-path is omitted, writes to .env in the project root.
|
|
# Will NOT overwrite an existing .env unless --force is passed.
|
|
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
|
EXAMPLE_FILE="$PROJECT_ROOT/.env.example"
|
|
FORCE=false
|
|
OUTPUT=""
|
|
|
|
for arg in "$@"; do
|
|
case "$arg" in
|
|
--force) FORCE=true ;;
|
|
*) OUTPUT="$arg" ;;
|
|
esac
|
|
done
|
|
|
|
OUTPUT="${OUTPUT:-$PROJECT_ROOT/.env}"
|
|
|
|
if [[ -f "$OUTPUT" ]] && ! $FORCE; then
|
|
echo "Error: $OUTPUT already exists. Use --force to overwrite."
|
|
exit 1
|
|
fi
|
|
|
|
if [[ ! -f "$EXAMPLE_FILE" ]]; then
|
|
echo "Error: .env.example not found at $EXAMPLE_FILE"
|
|
exit 1
|
|
fi
|
|
|
|
# Generate cryptographically random values
|
|
generate_password() {
|
|
local len="${1:-24}"
|
|
# Use openssl if available, fallback to /dev/urandom
|
|
if command -v openssl &>/dev/null; then
|
|
openssl rand -base64 "$((len * 3 / 4 + 1))" | tr -dc 'A-Za-z0-9' | head -c "$len"
|
|
else
|
|
head -c "$((len * 2))" /dev/urandom | LC_ALL=C tr -dc 'A-Za-z0-9' | head -c "$len"
|
|
fi
|
|
}
|
|
|
|
generate_hex() {
|
|
local len="${1:-32}"
|
|
if command -v openssl &>/dev/null; then
|
|
openssl rand -hex "$((len / 2))"
|
|
else
|
|
head -c "$((len / 2))" /dev/urandom | od -An -tx1 | tr -d ' \n' | head -c "$len"
|
|
fi
|
|
}
|
|
|
|
AUTH_PASS="$(generate_password 24)"
|
|
API_KEY="$(generate_hex 32)"
|
|
AUTH_SECRET="$(generate_password 32)"
|
|
|
|
# Copy .env.example and replace default secrets
|
|
cp "$EXAMPLE_FILE" "$OUTPUT"
|
|
|
|
# Replace the insecure defaults with generated values
|
|
if [[ "$(uname)" == "Darwin" ]]; then
|
|
sed -i '' "s|^AUTH_PASS=.*|AUTH_PASS=$AUTH_PASS|" "$OUTPUT"
|
|
sed -i '' "s|^API_KEY=.*|API_KEY=$API_KEY|" "$OUTPUT"
|
|
sed -i '' "s|^AUTH_SECRET=.*|AUTH_SECRET=$AUTH_SECRET|" "$OUTPUT"
|
|
else
|
|
sed -i "s|^AUTH_PASS=.*|AUTH_PASS=$AUTH_PASS|" "$OUTPUT"
|
|
sed -i "s|^API_KEY=.*|API_KEY=$API_KEY|" "$OUTPUT"
|
|
sed -i "s|^AUTH_SECRET=.*|AUTH_SECRET=$AUTH_SECRET|" "$OUTPUT"
|
|
fi
|
|
|
|
# Lock down permissions
|
|
chmod 600 "$OUTPUT"
|
|
|
|
echo "Generated secure .env at $OUTPUT"
|
|
echo " AUTH_USER: admin"
|
|
echo " AUTH_PASS: $AUTH_PASS"
|
|
echo " API_KEY: $API_KEY"
|
|
echo ""
|
|
echo "Save these credentials — they are not stored elsewhere."
|