69 lines
2.4 KiB
Bash
69 lines
2.4 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
# One-time bootstrap: register the wallet auth-proxy as Forgejo's OIDC provider.
|
||
|
|
# Idempotent — safe to re-run; will fail with "already exists" on second run.
|
||
|
|
#
|
||
|
|
# Run this AFTER `docker compose up -d` and after Forgejo's healthcheck passes
|
||
|
|
# (its Postgres schema needs to be initialised before we can add an auth source).
|
||
|
|
#
|
||
|
|
# Usage:
|
||
|
|
# bash scripts/bootstrap-auth.sh
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
# shellcheck disable=SC1091
|
||
|
|
[[ -f "$(dirname "$0")/../.env" ]] && source "$(dirname "$0")/../.env"
|
||
|
|
|
||
|
|
: "${AUTH_PROXY_CLIENT_ID:?}"
|
||
|
|
: "${AUTH_PROXY_CLIENT_SECRET:?}"
|
||
|
|
: "${AUTH_PROXY_ISSUER:?}"
|
||
|
|
|
||
|
|
echo "Waiting for Forgejo to be ready…"
|
||
|
|
for i in {1..60}; do
|
||
|
|
if docker compose exec -T forgejo forgejo --version >/dev/null 2>&1; then
|
||
|
|
break
|
||
|
|
fi
|
||
|
|
sleep 2
|
||
|
|
done
|
||
|
|
|
||
|
|
# Same wait for auth-proxy — its /.well-known/openid-configuration must return 200
|
||
|
|
# before Forgejo will accept the auth source (it calls discovery on add).
|
||
|
|
echo "Waiting for auth-proxy to be ready…"
|
||
|
|
for i in {1..60}; do
|
||
|
|
if docker compose exec -T forgejo wget -qO- "${AUTH_PROXY_ISSUER}/.well-known/openid-configuration" >/dev/null 2>&1; then
|
||
|
|
break
|
||
|
|
fi
|
||
|
|
sleep 2
|
||
|
|
done
|
||
|
|
|
||
|
|
ADMIN_USER="${HEPHAESTUS_ADMIN_USER:-hephaestus-admin}"
|
||
|
|
ADMIN_PW="${HEPHAESTUS_ADMIN_PASSWORD:-$(openssl rand -base64 24 | tr -d '=+/' | cut -c1-24)}"
|
||
|
|
ADMIN_EMAIL="${HEPHAESTUS_ADMIN_EMAIL:-admin@hephaestus.local}"
|
||
|
|
|
||
|
|
echo "Creating admin user '${ADMIN_USER}' (idempotent — 'already exists' is fine)…"
|
||
|
|
docker compose exec -T --user 1000 forgejo forgejo admin user create \
|
||
|
|
--admin \
|
||
|
|
--username "${ADMIN_USER}" \
|
||
|
|
--email "${ADMIN_EMAIL}" \
|
||
|
|
--password "${ADMIN_PW}" \
|
||
|
|
--must-change-password=false 2>&1 | tail -3 || true
|
||
|
|
|
||
|
|
echo ""
|
||
|
|
echo "Registering OIDC auth source 'hephaestus-wallet' in Forgejo…"
|
||
|
|
docker compose exec -T --user 1000 forgejo forgejo admin auth add-oauth \
|
||
|
|
--provider openidConnect \
|
||
|
|
--name hephaestus-wallet \
|
||
|
|
--key "${AUTH_PROXY_CLIENT_ID}" \
|
||
|
|
--secret "${AUTH_PROXY_CLIENT_SECRET}" \
|
||
|
|
--auto-discover-url "${AUTH_PROXY_ISSUER}/.well-known/openid-configuration" \
|
||
|
|
--scopes "openid profile" \
|
||
|
|
--group-claim-name "" \
|
||
|
|
--skip-local-2fa 2>&1 | tail -5
|
||
|
|
|
||
|
|
echo ""
|
||
|
|
echo "=== Bootstrap complete ==="
|
||
|
|
echo "Admin credentials (save these somewhere — needed for site admin):"
|
||
|
|
echo " URL: ${FORGEJO_ROOT_URL}"
|
||
|
|
echo " Username: ${ADMIN_USER}"
|
||
|
|
echo " Password: ${ADMIN_PW}"
|
||
|
|
echo ""
|
||
|
|
echo "For normal use: log in at ${FORGEJO_ROOT_URL} → 'Sign in with hephaestus-wallet'."
|