test

tools/clean_secrets.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SERVICES_DIR="${ROOT_DIR}/infrastructure/services"
+
+FORCE=0
+if [[ "${1:-}" == "-y" || "${1:-}" == "--force" ]]; then
+	FORCE=1
+fi
+
+mapfile -d '' -t targets < <(find "${SERVICES_DIR}" -type f -name '*.env' -print0 | sort -z)
+
+if [[ "${#targets[@]}" -eq 0 ]]; then
+	echo "No .env file found, nothing to do."
+	exit 0
+fi
+
+echo "This will permanently delete ${#targets[@]} .env file(s) (secrets/passwords included):"
+printf '  %s\n' "${targets[@]/#${ROOT_DIR}\//}"
+
+if [[ "${FORCE}" -ne 1 ]]; then
+	read -r -p "Continue? [y/N] " reply
+	if [[ ! "${reply}" =~ ^[Yy]$ ]]; then
+		echo "Aborted."
+		exit 1
+	fi
+fi
+
+rm -f -- "${targets[@]}"
+
+echo "Deleted ${#targets[@]} .env file(s). Run 'make init' to regenerate them."

tools/init_secrets.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SERVICES_DIR="${ROOT_DIR}/infrastructure/services"
+
+random_value() {
+	openssl rand -base64 16
+}
+
+mapfile -d '' -t examples < <(find "${SERVICES_DIR}" -type f -name '*.env.example' -print0 | sort -z)
+
+created=0
+skipped=0
+
+for example in "${examples[@]}"; do
+	target="${example%.example}"
+	if [[ -f "${target}" ]]; then
+		skipped=$((skipped + 1))
+		continue
+	fi
+	cp "${example}" "${target}"
+	created=$((created + 1))
+done
+
+mapfile -d '' -t targets < <(find "${SERVICES_DIR}" -type f -name '*.env' -print0)
+
+declare -A generated
+tokens="$(grep -hoE '__GENERATE_[A-Z0-9_]+__' "${targets[@]}" 2>/dev/null | sort -u || true)"
+
+for token in ${tokens}; do
+	if [[ -z "${generated[${token}]:-}" ]]; then
+		generated[${token}]="$(random_value)"
+	fi
+	value="${generated[${token}]}"
+	for f in "${targets[@]}"; do
+		if grep -qF -- "${token}" "${f}" 2>/dev/null; then
+			sed -i "s#${token}#${value}#g" "${f}"
+		fi
+	done
+done
+
+echo "Created ${created} env file(s), left ${skipped} existing one(s) untouched."
+
+remaining="$(grep -rlF 'CHANGEME_' "${targets[@]}" 2>/dev/null || true)"
+if [[ -n "${remaining}" ]]; then
+	echo
+	echo "These files still need a value you must fill in by hand:"
+	echo "${remaining}"
+fi