halkyon/deploy/host/halkyon-li-env.sh

#!/bin/sh
# Writes halkyon.li's first deploy/.env (ADR 0039; first-start.md, step 4), as deploy,
# on the instance's host at home:
#
#   sh deploy/host/halkyon-li-env.sh deploy/.env
#
# Every secret is made here and now (32 random bytes, in hex), and never leaves the
# host but into Proton Pass (vault Infra, a note "halkyon.li .env", the whole file).
# It refuses to write over an existing file: the session peppers and the database
# passwords must never change once the instance runs (.env.example says why for each).
# The settings are the developer's choices of 8 Nov 2026; .env.example explains each
# one. SimpleLogin's client ID and secret stay empty until its app is registered
# (first-start.md, step 5).
set -eu

target=${1:?usage: halkyon-li-env.sh <path of the new .env>}
if [ -e "$target" ]; then
  echo "Error: $target exists; its secrets must stay as they are." >&2
  exit 1
fi

secret() { openssl rand -hex 32; }

umask 077
cat >"$target" <<EOF
# halkyon.li's .env, written by deploy/host/halkyon-li-env.sh on $(date -u +%Y-%m-%d).
# Its secrets are in Proton Pass (Infra, "halkyon.li .env"). .env.example explains each
# setting.

# Names (ADR 0039, D7; Halkyon Days' ADR 0045, D22): Halkyon on halkyon.li itself,
# Myrmex on myrmex.li, each register's handles on its own domain.
HALKYON_DOMAIN=halkyon.li
HALKYON_PUBLIC_HOST=halkyon.li
TRAIN_DOMAIN=train.halkyon.li
MYRMEX_DOMAIN=myrmex.li
MEDITATE_DOMAIN=meditate.halkyon.li
JELLYFIN_DOMAIN=jellyfin.halkyon.li

# Everything runs, behind ramiel's forward (compose.forwarded.yaml last, its ports win).
COMPOSE_FILE=compose.halkyon.yaml:compose.jellyfin.yaml:compose.languagetool.yaml:compose.train.yaml:compose.maps.yaml:compose.search.yaml:compose.myrmex.yaml:compose.myrmex-search.yaml:compose.meditate.yaml:compose.forwarded.yaml

# Who comes in, at each app's own register (ADR 0045, D7, D9, D20): SimpleLogin alone,
# each register with an app of its own, approved by an operator (ADR 0039, D4). No
# mail, so neither email codes nor passwords. The client IDs and secrets from each
# SimpleLogin app (first-start.md, step 5).
HALKYON_SIGN_IN_WAYS=simplelogin
HALKYON_SIGN_UP=approval
HALKYON_SIGN_IN_DECOY_KEY=$(secret)
HALKYON_SIMPLELOGIN_CLIENT_ID=
HALKYON_SIMPLELOGIN_CLIENT_SECRET=
MYRMEX_SIGN_IN_WAYS=simplelogin
MYRMEX_SIGN_UP=approval
MYRMEX_SIGN_IN_DECOY_KEY=$(secret)
MYRMEX_SIMPLELOGIN_CLIENT_ID=
MYRMEX_SIMPLELOGIN_CLIENT_SECRET=
TRAIN_SIGN_IN_WAYS=simplelogin
TRAIN_SIGN_UP=approval
TRAIN_SIGN_IN_DECOY_KEY=$(secret)
TRAIN_SIMPLELOGIN_CLIENT_ID=
TRAIN_SIMPLELOGIN_CLIENT_SECRET=
MEDITATE_SIGN_IN_WAYS=simplelogin
MEDITATE_SIGN_UP=approval
MEDITATE_SIGN_IN_DECOY_KEY=$(secret)
MEDITATE_SIMPLELOGIN_CLIENT_ID=
MEDITATE_SIMPLELOGIN_CLIENT_SECRET=

# Halkyon: the instance's PostgreSQL superuser and Halkyon's session pepper.
HALKYON_POSTGRES_PASSWORD=$(secret)
HALKYON_SESSION_KEY_HASH_PEPPER=$(secret)

# Train, with BRouter, its own map and Photon. Until the Instance console cuts regions
# (ADR 0040): the map and routes over southern Bavaria, the search over Germany, the
# smallest Photon's databases come in, with memory to fit beside the rest.
TRAIN_POSTGRES_PASSWORD=$(secret)
TRAIN_SESSION_KEY_HASH_PEPPER=$(secret)
BROUTER_REGION=10,45,15,50
MAP_KEY_SECRET=$(secret)
MAP_REGION=10,47.2,13.9,49
PHOTON_REGION=europe/germany
PHOTON_HEAP=2g
PHOTON_MEMORY=3g

# Myrmex and Meditate (no library yet).
MYRMEX_POSTGRES_PASSWORD=$(secret)
MYRMEX_SESSION_KEY_HASH_PEPPER=$(secret)
MEDITATE_POSTGRES_PASSWORD=$(secret)
MEDITATE_SESSION_KEY_HASH_PEPPER=$(secret)

# Jellyfin's library on the HDD (sidecars/README.md, Jellyfin on halkyon.li).
JELLYFIN_MEDIA=/data/media

# What the app tells people: the iMac at home and the Storage Box, both in Germany.
DATA_LOCATION=DE
BACKUP_LOCATION=DE
EOF
echo "Written: $target"