25 lines
977 B
Bash
25 lines
977 B
Bash
#!/bin/bash
|
|
# Redeploy the admin stack (Authelia SSO + portal). Secrets are regenerated
|
|
# from the gitignored files in configs/ so nothing sensitive is committed.
|
|
# First-time setup: run scripts/gen-admin-secrets.sh before this.
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
|
|
HASH=$(/tmp/opencode/authelia/authelia crypto hash generate argon2 \
|
|
--password "$(cat configs/admin-password.txt)" 2>/dev/null | grep -o '\$argon2id\$.*')
|
|
SESSION=$(cat configs/authelia-session-secret.txt)
|
|
JWT=$(cat configs/authelia-jwt-secret.txt)
|
|
ENCKEY=$(openssl rand -base64 24 | tr -d "=+/" | cut -c1-32)
|
|
|
|
export HASH SESSION JWT ENCKEY
|
|
for f in manifests/admin/*.yaml; do
|
|
envsubst '\$HASH \$SESSION \$JWT \$ENCKEY' < "$f" | kubectl apply -f -
|
|
done
|
|
|
|
kubectl -n admin set env deployment/authelia \
|
|
AUTHELIA_SESSION_SECRET="$SESSION" \
|
|
AUTHELIA_STORAGE_ENCRYPTION_KEY="$ENCKEY" \
|
|
AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET="$JWT" \
|
|
>/dev/null
|
|
echo "admin stack deployed"
|