chore: import upstream snapshot with attribution

2026-07-13 13:12:00 +08:00
commit 3de48288cb
2986 changed files with 1131193 additions and 0 deletions
@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+# First-run helper: ensures deploy/docker/.env exists with the two
+# required secrets (POSTGRES_PASSWORD, OMNIGENT_OIDC_COOKIE_SECRET)
+# generated for you, instead of making the user run `openssl rand -hex 32`
+# twice. Safe to re-run — never overwrites existing non-default values.
+#
+# Usage:
+#   cd deploy/docker
+#   ./bootstrap.sh
+#   docker compose up -d
+#
+# Idempotency:
+#   - If .env doesn't exist, copies .env.example → .env first.
+#   - If POSTGRES_PASSWORD is unset, empty, or still the example
+#     placeholder ("change-me-please"), mints a fresh random value.
+#   - If OMNIGENT_OIDC_COOKIE_SECRET is unset OR commented out,
+#     uncomments + sets it to a fresh 64-hex-char value. (Even if
+#     you're not using OIDC today, having the secret ready means
+#     enabling it later is a one-line edit.)
+#   - Already-customized values are left alone.
+
+set -euo pipefail
+
+cd "$(dirname "$0")"
+
+if [[ ! -f .env ]]; then
+  cp .env.example .env
+  echo "→ created .env from .env.example"
+fi
+
+# openssl is the dependency we already document for cookie-secret
+# generation; bail loud if missing rather than papering over with a
+# weaker source.
+if ! command -v openssl >/dev/null 2>&1; then
+  echo "ERROR: openssl not found on PATH (needed to generate secrets)" >&2
+  exit 1
+fi
+
+# In-place edit helper that works on both GNU sed and BSD/macOS sed.
+sed_inplace() {
+  if sed --version >/dev/null 2>&1; then
+    sed -i "$@"
+  else
+    sed -i '' "$@"
+  fi
+}
+
+set_or_replace_kv() {
+  local key="$1" value="$2"
+  if grep -qE "^${key}=" .env; then
+    sed_inplace "s|^${key}=.*|${key}=${value}|" .env
+  elif grep -qE "^# *${key}=" .env; then
+    sed_inplace "s|^# *${key}=.*|${key}=${value}|" .env
+  else
+    printf '\n%s=%s\n' "$key" "$value" >> .env
+  fi
+}
+
+current_value() {
+  local key="$1"
+  grep -E "^${key}=" .env | head -n 1 | cut -d= -f2- || true
+}
+
+pg_current=$(current_value POSTGRES_PASSWORD)
+if [[ -z "$pg_current" || "$pg_current" == "change-me-please" ]]; then
+  set_or_replace_kv POSTGRES_PASSWORD "$(openssl rand -hex 16)"
+  echo "→ generated POSTGRES_PASSWORD"
+else
+  echo "→ POSTGRES_PASSWORD already set, leaving alone"
+fi
+
+cookie_current=$(current_value OMNIGENT_OIDC_COOKIE_SECRET)
+if [[ -z "$cookie_current" || "$cookie_current" == "<64-hex-chars>" ]]; then
+  set_or_replace_kv OMNIGENT_OIDC_COOKIE_SECRET "$(openssl rand -hex 32)"
+  echo "→ generated OMNIGENT_OIDC_COOKIE_SECRET"
+else
+  echo "→ OMNIGENT_OIDC_COOKIE_SECRET already set, leaving alone"
+fi
+
+# Same generation logic for the accounts cookie secret. The two
+# secrets are independent — OIDC and accounts modes are mutually
+# exclusive in a single deploy, but having both pre-minted means
+# the operator can switch modes by editing OMNIGENT_AUTH_PROVIDER
+# without re-running bootstrap.
+accounts_cookie_current=$(current_value OMNIGENT_ACCOUNTS_COOKIE_SECRET)
+if [[ -z "$accounts_cookie_current" || "$accounts_cookie_current" == "<64-hex-chars>" ]]; then
+  set_or_replace_kv OMNIGENT_ACCOUNTS_COOKIE_SECRET "$(openssl rand -hex 32)"
+  echo "→ generated OMNIGENT_ACCOUNTS_COOKIE_SECRET"
+else
+  echo "→ OMNIGENT_ACCOUNTS_COOKIE_SECRET already set, leaving alone"
+fi
+
+echo
+echo "✓ deploy/docker/.env is ready. Next:"
+echo "    docker compose up -d && docker compose logs omnigent"
+echo
+echo "  Accounts mode is the default — the first-boot admin password"
+echo "  lands in the logs and in /data/admin-credentials on the"
+echo "  persistent volume. For any public-domain deploy also set:"
+echo "    OMNIGENT_ACCOUNTS_BASE_URL=<your public URL>"
+echo "  in .env so invite links resolve to the right host."