From f57edc5fcd36bce9bcf36e942fd99a0c11d9b0f2d1b35cc9d59fef53fc38e934 Mon Sep 17 00:00:00 2001 From: wlfb Date: Sun, 19 Jul 2026 15:06:21 +0200 Subject: [PATCH] feat: Secrets unter ~/.local/share/finance_pod (Backup-vollstaendig) Co-Authored-By: Claude Fable 5 --- create_pod_finance.sh | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/create_pod_finance.sh b/create_pod_finance.sh index 151c556..a617cae 100755 --- a/create_pod_finance.sh +++ b/create_pod_finance.sh @@ -43,12 +43,23 @@ INBOX_DIR="$DATA_DIR/inbox" UPLOADS_DIR="$DATA_DIR/uploads" USER_SYSTEMD_DIR="$HOME/.config/systemd/user" -ENV_FILE="$FINANCE_DIR/.env" GRAFANA_PROVISIONING_DIR="$FINANCE_DIR/grafana/provisioning" GRAFANA_DASHBOARDS_DIR="$FINANCE_DIR/grafana/dashboards" # --- Secrets bootstrap ------------------------------------------------------- -# On first run, generate all secrets into finance/.env (gitignored) and print +# Secrets live under BIND_DIR (not the code checkout in FINANCE_DIR), so a +# backup of BIND_DIR plus this script alone are sufficient for disaster +# recovery. BIND_DIR must exist and be private before .env is written into it. +mkdir -p "$BIND_DIR" && chmod 700 "$BIND_DIR" + +ENV_FILE="$BIND_DIR/.env" +LEGACY_ENV="$HOME/bin/finance/.env" +if [ ! -f "$ENV_FILE" ] && [ -f "$LEGACY_ENV" ]; then + mv "$LEGACY_ENV" "$ENV_FILE" && chmod 600 "$ENV_FILE" + echo "MIGRIERT: .env nach $ENV_FILE verschoben" +fi + +# On first run, generate all secrets into $ENV_FILE (gitignored) and print # the GUI login password once. On subsequent runs the existing .env is reused # unchanged, so re-running this script never rotates secrets under existing # data.