67 lines
2 KiB
Bash
67 lines
2 KiB
Bash
#!/bin/bash
|
|
# vault-sync.sh - Sync Vaultwarden items to Butler's persistent cache volume.
|
|
# Runtime credentials live in .vault-sync.env (mode 0600, never in Git).
|
|
set -euo pipefail
|
|
|
|
ENV_FILE="${VAULT_SYNC_ENV:-/app-config/homelab-butler/.vault-sync.env}"
|
|
if [[ ! -r "$ENV_FILE" ]]; then
|
|
echo "vault-sync: protected environment file missing or unreadable" >&2
|
|
exit 1
|
|
fi
|
|
|
|
set -a
|
|
# shellcheck disable=SC1090
|
|
source "$ENV_FILE"
|
|
set +a
|
|
|
|
: "${BW_CLIENTID:?BW_CLIENTID missing}"
|
|
: "${BW_CLIENTSECRET:?BW_CLIENTSECRET missing}"
|
|
if [[ -z "${BW_PASSWORD:-}" && -n "${BW_MASTER_PASSWORD:-}" ]]; then
|
|
export BW_PASSWORD="$BW_MASTER_PASSWORD"
|
|
fi
|
|
: "${BW_PASSWORD:?BW_PASSWORD missing}"
|
|
|
|
CACHE_DIR=$(sudo docker inspect homelab-butler --format '{{range .Mounts}}{{if eq .Destination "/data/vault-cache"}}{{.Source}}{{end}}{{end}}' 2>/dev/null)
|
|
if [[ -z "$CACHE_DIR" ]]; then
|
|
echo "vault-sync: Butler cache volume not found" >&2
|
|
exit 1
|
|
fi
|
|
|
|
BW_STATE=$(bw status 2>/dev/null | python3 -c 'import json,sys; print(json.load(sys.stdin).get("status", "unknown"))')
|
|
if [[ "$BW_STATE" == "unauthenticated" ]]; then
|
|
bw login --apikey --raw >/dev/null
|
|
fi
|
|
|
|
SESSION=$(bw unlock --passwordenv BW_PASSWORD --raw 2>/dev/null)
|
|
if [[ -z "$SESSION" ]]; then
|
|
echo "vault-sync: Vault unlock failed" >&2
|
|
exit 1
|
|
fi
|
|
|
|
bw sync --session "$SESSION" >/dev/null
|
|
|
|
bw list items --session "$SESSION" | sudo python3 -c "
|
|
import json
|
|
import os
|
|
import re
|
|
import sys
|
|
|
|
items = json.load(sys.stdin)
|
|
cache_dir = '$CACHE_DIR'
|
|
os.makedirs(cache_dir, exist_ok=True)
|
|
count = 0
|
|
for item in items:
|
|
name = item.get('name', '')
|
|
notes = item.get('notes') or ''
|
|
safe = re.sub(r'[^a-z0-9._-]+', '-', name.lower()).strip('.-')
|
|
if not safe or not notes:
|
|
continue
|
|
path = os.path.join(cache_dir, safe)
|
|
tmp = path + '.tmp'
|
|
with open(tmp, 'w') as handle:
|
|
handle.write(notes.strip())
|
|
os.chmod(tmp, 0o600)
|
|
os.replace(tmp, path)
|
|
count += 1
|
|
print(f'vault-sync: {count} items written')
|
|
"
|