wlfb/bin
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Secrets unter ~/.local/share/finance_pod (Backup-vollstaendig)

Browse Source 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
wlfb
2026-07-19 15:06:21 +02:00
parent bba04db663
commit f57edc5fcd
1 changed files with 13 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
create_pod_finance.sh
View File

@@ -43,12 +43,23 @@ INBOX_DIR="$DATA_DIR/inbox"
UPLOADS_DIR="$DATA_DIR/uploads"
USER_SYSTEMD_DIR="$HOME/.config/systemd/user"
ENV_FILE="$FINANCE_DIR/.env"
GRAFANA_PROVISIONING_DIR="$FINANCE_DIR/grafana/provisioning"
GRAFANA_DASHBOARDS_DIR="$FINANCE_DIR/grafana/dashboards"
# --- Secrets bootstrap -------------------------------------------------------
# On first run, generate all secrets into finance/.env (gitignored) and print
# Secrets live under BIND_DIR (not the code checkout in FINANCE_DIR), so a
# backup of BIND_DIR plus this script alone are sufficient for disaster
# recovery. BIND_DIR must exist and be private before .env is written into it.
mkdir -p "$BIND_DIR" && chmod 700 "$BIND_DIR"
ENV_FILE="$BIND_DIR/.env"
LEGACY_ENV="$HOME/bin/finance/.env"
if [ ! -f "$ENV_FILE" ] && [ -f "$LEGACY_ENV" ]; then
mv "$LEGACY_ENV" "$ENV_FILE" && chmod 600 "$ENV_FILE"
echo "MIGRIERT: .env nach $ENV_FILE verschoben"
fi
# On first run, generate all secrets into $ENV_FILE (gitignored) and print
# the GUI login password once. On subsequent runs the existing .env is reused
# unchanged, so re-running this script never rotates secrets under existing
# data.