every-channel/every.channel
1
0
Fork 0
Code Releases Activity Actions 2

scripts: decrypt agenix secrets with explicit identity

Browse source
This commit is contained in:
every.channel 2026-02-16 00:24:14 -05:00
parent 223272db7d
commit 4cd58a4bd7
No known key found for this signature in database
2 changed files with 7 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/deploy-workers.sh
View file

@ -9,6 +9,8 @@ cd "${root}"
token_file="${EVERY_CHANNEL_CF_TOKEN_FILE:-}" token_file="${EVERY_CHANNEL_CF_TOKEN_FILE:-}"
account_file="${EVERY_CHANNEL_CF_ACCOUNT_FILE:-}" account_file="${EVERY_CHANNEL_CF_ACCOUNT_FILE:-}"
agenix_secret="${EVERY_CHANNEL_CF_TOKEN_AGE_SECRET:-secrets/cloudflare-api-token.age}" agenix_secret="${EVERY_CHANNEL_CF_TOKEN_AGE_SECRET:-secrets/cloudflare-api-token.age}"
rules_file="${EVERY_CHANNEL_AGE_RULES_FILE:-./secrets.nix}"
identity_file="${EVERY_CHANNEL_AGE_IDENTITY_FILE:-$HOME/.config/every.channel/keys/founder_ed25519}"
if [[ -z "${CLOUDFLARE_API_TOKEN:-}" && -n "${token_file}" && -f "${token_file}" ]]; then if [[ -z "${CLOUDFLARE_API_TOKEN:-}" && -n "${token_file}" && -f "${token_file}" ]]; then
export CLOUDFLARE_API_TOKEN export CLOUDFLARE_API_TOKEN
@ -22,7 +24,7 @@ fi
if [[ -z "${CLOUDFLARE_API_TOKEN:-}" && -f "${agenix_secret}" && -x "$(command -v agenix)" ]]; then if [[ -z "${CLOUDFLARE_API_TOKEN:-}" && -f "${agenix_secret}" && -x "$(command -v agenix)" ]]; then
export CLOUDFLARE_API_TOKEN export CLOUDFLARE_API_TOKEN
CLOUDFLARE_API_TOKEN="$(agenix -d "${agenix_secret}")" CLOUDFLARE_API_TOKEN="$(RULES="${rules_file}" agenix -d "${agenix_secret}" -i "${identity_file}")"
fi fi
if [[ -z "${CLOUDFLARE_API_TOKEN:-}" ]]; then if [[ -z "${CLOUDFLARE_API_TOKEN:-}" ]]; then

6
scripts/fj-auth-codeberg.sh
View file

@ -10,9 +10,12 @@ cd "${root}"
# 1) CODEBERG_TOKEN env var # 1) CODEBERG_TOKEN env var
# 2) `agenix -d secrets/codeberg-token.age` (optional) # 2) `agenix -d secrets/codeberg-token.age` (optional)
rules_file="${EVERY_CHANNEL_AGE_RULES_FILE:-./secrets.nix}"
identity_file="${EVERY_CHANNEL_AGE_IDENTITY_FILE:-$HOME/.config/every.channel/keys/founder_ed25519}"
if [[ -z "${CODEBERG_TOKEN:-}" && -f secrets/codeberg-token.age && -x "$(command -v agenix)" ]]; then if [[ -z "${CODEBERG_TOKEN:-}" && -f secrets/codeberg-token.age && -x "$(command -v agenix)" ]]; then
export CODEBERG_TOKEN export CODEBERG_TOKEN
CODEBERG_TOKEN="$(agenix -d secrets/codeberg-token.age)" CODEBERG_TOKEN="$(RULES="${rules_file}" agenix -d secrets/codeberg-token.age -i "${identity_file}")"
fi fi
if [[ -z "${CODEBERG_TOKEN:-}" ]]; then if [[ -z "${CODEBERG_TOKEN:-}" ]]; then
@ -24,4 +27,3 @@ fi
# Avoid passing the token on the command line (shows up in process listings); use stdin. # Avoid passing the token on the command line (shows up in process listings); use stdin.
printf "%s" "${CODEBERG_TOKEN}" | fj -H https://codeberg.org auth add-key every-channel printf "%s" "${CODEBERG_TOKEN}" | fj -H https://codeberg.org auth add-key every-channel
echo "fj configured. Try: fj -H https://codeberg.org whoami" echo "fj configured. Try: fj -H https://codeberg.org whoami"