58597ad4fd
- poller/docker-entrypoint.sh: convert from CRLF+BOM to LF (UTF-8 no BOM) Windows saved the file with a UTF-8 BOM which made the Linux kernel reject the shebang with 'exec format error', crashing the poller. - infrastructure/openbao/init.sh: same CRLF -> LF fix - poller/Dockerfile: add sed to strip CRLF and BOM at image build time as a defensive measure for future Windows edits - docker-compose.override.yml: add 'restart: on-failure' to api and poller so they recover from the postgres startup race (TimescaleDB restarts postgres after initdb, briefly causing connection refused on first boot) - .gitattributes: enforce LF for all text/script/code files so git normalises line endings on checkout and prevents this class of bug
39 lines
993 B
Bash
Executable File
39 lines
993 B
Bash
Executable File
#!/bin/sh
|
|
# OpenBao Transit initialization script
|
|
# Runs after OpenBao starts in dev mode
|
|
|
|
set -e
|
|
|
|
export BAO_ADDR="http://127.0.0.1:8200"
|
|
export BAO_TOKEN="${BAO_DEV_ROOT_TOKEN_ID:-dev-openbao-token}"
|
|
|
|
# Wait for OpenBao to be ready
|
|
echo "Waiting for OpenBao to start..."
|
|
until bao status >/dev/null 2>&1; do
|
|
sleep 0.5
|
|
done
|
|
echo "OpenBao is ready"
|
|
|
|
# Enable Transit secrets engine (idempotent - ignores "already enabled" errors)
|
|
bao secrets enable transit 2>/dev/null || true
|
|
echo "Transit engine enabled"
|
|
|
|
# Create policy for the API backend (full Transit access)
|
|
bao policy write api-policy - <<'POLICY'
|
|
path "transit/*" {
|
|
capabilities = ["create", "read", "update", "delete", "list"]
|
|
}
|
|
POLICY
|
|
|
|
# Create policy for the Go poller (encrypt + decrypt only)
|
|
bao policy write poller-policy - <<'POLICY'
|
|
path "transit/decrypt/tenant_*" {
|
|
capabilities = ["update"]
|
|
}
|
|
path "transit/encrypt/tenant_*" {
|
|
capabilities = ["update"]
|
|
}
|
|
POLICY
|
|
|
|
echo "OpenBao Transit initialization complete"
|