tegwick
d5bb4f66f2
Add forgejo-mailer ExternalSecret, inject GITEA__mailer__PASSWD from the synced Secret, remove mailer from SOPS overlay, and add ESO bootstrap targets.
42 lines
No EOL
1.3 KiB
Bash
Executable file
42 lines
No EOL
1.3 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Emit Helm values for Forgejo DB + admin secrets (no mailer — OpenBao/ESO owns SMTP).
|
|
set -euo pipefail
|
|
|
|
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
SECRETS_FILE="${FORGEJO_SECRETS:-$ROOT_DIR/helm/forgejo-secrets.sops.yaml}"
|
|
KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config-hosteurope}"
|
|
|
|
emit_from_sops() {
|
|
sops -d "$SECRETS_FILE" | python3 -c "
|
|
import sys, yaml
|
|
data = yaml.safe_load(sys.stdin) or {}
|
|
mailer = data.get('gitea', {}).get('config', {}).get('mailer')
|
|
if mailer:
|
|
data['gitea']['config'].pop('mailer', None)
|
|
yaml.dump(data, sys.stdout, default_flow_style=False)
|
|
"
|
|
}
|
|
|
|
emit_from_cluster() {
|
|
python3 -c "
|
|
import json, os, subprocess, sys, yaml
|
|
os.environ['KUBECONFIG'] = '${KUBECONFIG}'
|
|
vals = json.loads(subprocess.check_output(
|
|
['helm', 'get', 'values', 'forgejo', '-n', 'forgejo', '-o', 'json'], text=True))
|
|
g = vals.get('gitea', {})
|
|
yaml.dump({
|
|
'gitea': {
|
|
'admin': {'password': g.get('admin', {}).get('password', '')},
|
|
'config': {
|
|
'database': {'PASSWD': g.get('config', {}).get('database', {}).get('PASSWD', '')},
|
|
},
|
|
}
|
|
}, sys.stdout, default_flow_style=False)
|
|
"
|
|
}
|
|
|
|
if command -v sops >/dev/null 2>&1 && sops -d "$SECRETS_FILE" >/dev/null 2>&1; then
|
|
emit_from_sops
|
|
else
|
|
emit_from_cluster
|
|
fi |