mirror of
https://github.com/MaksTinyWorkshop/_Assistant_Lead_Tech
synced 2026-04-06 13:31:43 +02:00
76 lines
1.9 KiB
Bash
Executable File
76 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
_sync_project_secrets() {
|
|
source "$LEADTECH/scripts/env_paths.sh" || { echo "env_paths.sh introuvable" >&2; return 1; }
|
|
|
|
if [ ! -f "$SECRETS_KDBX" ]; then
|
|
echo "Coffre introuvable : $SECRETS_KDBX" >&2
|
|
return 1
|
|
fi
|
|
|
|
if ! command -v keepassxc-cli >/dev/null 2>&1; then
|
|
echo "keepassxc-cli introuvable" >&2
|
|
return 1
|
|
fi
|
|
|
|
if ! command -v expect >/dev/null 2>&1; then
|
|
echo "expect introuvable" >&2
|
|
return 1
|
|
fi
|
|
|
|
# Nom du projet = nom du dossier courant
|
|
local project_name
|
|
project_name="$(basename "$PWD")"
|
|
local entry_path="projects/$project_name"
|
|
local target_file="$PWD/.env"
|
|
|
|
echo "Projet détecté : $project_name" >&2
|
|
echo "Entrée KeePass : $entry_path" >&2
|
|
|
|
if [ -z "${KDBX_PASSWORD:-}" ]; then
|
|
printf "Mot de passe KeePassXC : " >&2
|
|
stty -echo
|
|
IFS= read -r KDBX_PASSWORD
|
|
stty echo
|
|
printf '\n' >&2
|
|
fi
|
|
|
|
echo "Récupération des secrets projet..." >&2
|
|
|
|
# Lire le champ Notes de l'entrée — une seule ouverture du coffre
|
|
local notes
|
|
notes=$(KDBX_PASSWORD="$KDBX_PASSWORD" SECRETS_KDBX="$SECRETS_KDBX" ENTRY_PATH="$entry_path" expect <<'EOF'
|
|
log_user 0
|
|
set timeout 15
|
|
spawn keepassxc-cli show -a notes $env(SECRETS_KDBX) $env(ENTRY_PATH)
|
|
expect "Saisir le mot de passe pour déverrouiller*"
|
|
send -- "$env(KDBX_PASSWORD)\r"
|
|
expect eof
|
|
catch wait result
|
|
puts -nonewline $expect_out(buffer)
|
|
exit [lindex $result 3]
|
|
EOF
|
|
) || {
|
|
echo "Impossible de lire l'entrée '$entry_path'." >&2
|
|
return 1
|
|
}
|
|
|
|
if [ -z "$notes" ]; then
|
|
echo "Le champ Notes est vide pour '$project_name'." >&2
|
|
return 1
|
|
fi
|
|
|
|
# Écrire le .env
|
|
printf '%s\n' "$notes" > "$target_file"
|
|
chmod 600 "$target_file"
|
|
|
|
local loaded
|
|
loaded=$(grep -c '.' "$target_file" || true)
|
|
|
|
echo "Secrets écrits dans : $target_file"
|
|
echo "Lignes écrites : $loaded"
|
|
}
|
|
|
|
_sync_project_secrets
|
|
unset -f _sync_project_secrets
|