83 lines
3.1 KiB
Shell
83 lines
3.1 KiB
Shell
|
#!/bin/sh
|
||
|
|
# Writes halkyon.li's first deploy/.env (ADR 0039; first-start.md, step 4), as deploy,
|
||
|
|
# on the instance's host at home:
|
||
|
|
#
|
||
|
|
# sh deploy/host/halkyon-li-env.sh deploy/.env
|
||
|
|
#
|
||
|
|
# Every secret is made here and now (32 random bytes, in hex), and never leaves the
|
||
|
|
# host but into Proton Pass (vault Infra, a note "halkyon.li .env", the whole file).
|
||
|
|
# It refuses to write over an existing file: the session peppers and the database
|
||
|
|
# passwords must never change once the instance runs (.env.example says why for each).
|
||
|
|
# The settings are the developer's choices of 8 Nov 2026; .env.example explains each
|
||
|
|
# one. SimpleLogin's client ID and secret stay empty until its app is registered
|
||
|
|
# (first-start.md, step 5).
|
||
|
|
set -eu
|
||
|
|
|
||
|
|
target=${1:?usage: halkyon-li-env.sh <path of the new .env>}
|
||
|
|
if [ -e "$target" ]; then
|
||
|
|
echo "Error: $target exists; its secrets must stay as they are." >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
secret() { openssl rand -hex 32; }
|
||
|
|
|
||
|
|
umask 077
|
||
|
|
cat >"$target" <<EOF
|
||
|
|
# halkyon.li's .env, written by deploy/host/halkyon-li-env.sh on $(date -u +%Y-%m-%d).
|
||
|
|
# Its secrets are in Proton Pass (Infra, "halkyon.li .env"). .env.example explains each
|
||
|
|
# setting.
|
||
|
|
|
||
|
|
# Names (ADR 0039, D7): handles on halkyon.li itself.
|
||
|
|
LEARN_DOMAIN=learn.halkyon.li
|
||
|
|
LEARN_PUBLIC_HOST=learn.halkyon.li
|
||
|
|
ACCOUNT_DOMAIN=halkyon.li
|
||
|
|
TRAIN_DOMAIN=train.halkyon.li
|
||
|
|
TODO_DOMAIN=todo.halkyon.li
|
||
|
|
MEDITATE_DOMAIN=meditate.halkyon.li
|
||
|
|
JELLYFIN_DOMAIN=jellyfin.halkyon.li
|
||
|
|
|
||
|
|
# Everything runs, behind ramiel's forward (compose.forwarded.yaml last, its ports win).
|
||
|
|
COMPOSE_FILE=compose.learn.yaml:compose.jellyfin.yaml:compose.languagetool.yaml:compose.train.yaml:compose.maps.yaml:compose.search.yaml:compose.todo.yaml:compose.todo-search.yaml:compose.meditate.yaml:compose.forwarded.yaml
|
||
|
|
|
||
|
|
# The register (ADR 0016), which the four services share.
|
||
|
|
INSTANCE_SECRET=$(secret)
|
||
|
|
|
||
|
|
# Who comes in: SimpleLogin alone, approved by an operator (ADR 0039, D4). No mail, so
|
||
|
|
# neither email codes nor passwords.
|
||
|
|
SIGN_IN_WAYS=simplelogin
|
||
|
|
SIGN_UP=approval
|
||
|
|
SIGN_IN_DECOY_KEY=$(secret)
|
||
|
|
# From SimpleLogin's app (first-start.md, step 5).
|
||
|
|
SIMPLELOGIN_CLIENT_ID=
|
||
|
|
SIMPLELOGIN_CLIENT_SECRET=
|
||
|
|
|
||
|
|
# Learn: the instance's PostgreSQL superuser and Learn's session pepper.
|
||
|
|
LEARN_POSTGRES_PASSWORD=$(secret)
|
||
|
|
LEARN_SESSION_KEY_HASH_PEPPER=$(secret)
|
||
|
|
|
||
|
|
# Train, with BRouter, its own map and Photon. Until the Instance console cuts regions
|
||
|
|
# (ADR 0040): the map and routes over southern Bavaria, the search over Germany, the
|
||
|
|
# smallest Photon's databases come in, with memory to fit beside the rest.
|
||
|
|
TRAIN_POSTGRES_PASSWORD=$(secret)
|
||
|
|
TRAIN_SESSION_KEY_HASH_PEPPER=$(secret)
|
||
|
|
BROUTER_REGION=10,45,15,50
|
||
|
|
MAP_KEY_SECRET=$(secret)
|
||
|
|
MAP_REGION=10,47.2,13.9,49
|
||
|
|
PHOTON_REGION=europe/germany
|
||
|
|
PHOTON_HEAP=2g
|
||
|
|
PHOTON_MEMORY=3g
|
||
|
|
|
||
|
|
# Todo and Meditate (no library yet).
|
||
|
|
TODO_POSTGRES_PASSWORD=$(secret)
|
||
|
|
TODO_SESSION_KEY_HASH_PEPPER=$(secret)
|
||
|
|
MEDITATE_POSTGRES_PASSWORD=$(secret)
|
||
|
|
MEDITATE_SESSION_KEY_HASH_PEPPER=$(secret)
|
||
|
|
|
||
|
|
# Jellyfin's library on the HDD (sidecars/README.md, Jellyfin on halkyon.li).
|
||
|
|
JELLYFIN_MEDIA=/data/media
|
||
|
|
|
||
|
|
# What the app tells people: the iMac at home and the Storage Box, both in Germany.
|
||
|
|
DATA_LOCATION=DE
|
||
|
|
BACKUP_LOCATION=DE
|
||
|
|
EOF
|
||
|
|
echo "Written: $target"
|