Lutz Finsterle
37a97cb0f4
Store the gitea PAT in OpenBAO KV (secret/gitea/push) and fetch it via a git credential helper instead of keeping it in ~/.git-credentials: - scripts/git-credential-openbao.sh: helper that reads the cred from the OpenBAO API using a scoped, read-only periodic token - scripts/store-gitea-cred.sh: one-time hidden-input store of the PAT - README: usage + rotation notes Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
27 lines
1.1 KiB
Bash
Executable File
27 lines
1.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Store a gitea username + PAT into OpenBAO KV at secret/gitea/push.
|
|
# Prompts for the PAT silently so it never appears in shell history or logs.
|
|
# Run from the project dir: ./scripts/store-gitea-cred.sh
|
|
set -euo pipefail
|
|
|
|
ADDR="${BAO_ADDR:-http://127.0.0.1:8200}"
|
|
INIT="/home/lutz/Projects/OpenBAO/init-output.json"
|
|
|
|
read -rp "gitea username [lutz]: " U; U="${U:-lutz}"
|
|
read -rsp "gitea personal access token (input hidden): " P; echo
|
|
[ -n "$P" ] || { echo "no token entered, aborting"; exit 1; }
|
|
|
|
# Use the root token locally to write the secret (admin would also work).
|
|
TOKEN="$(python3 -c "import json;print(json.load(open('$INIT'))['root_token'])")"
|
|
|
|
# Build JSON safely with python (handles any special chars in the token).
|
|
payload="$(U="$U" P="$P" python3 -c 'import json,os;print(json.dumps({"data":{"username":os.environ["U"],"token":os.environ["P"]}}))')"
|
|
|
|
code="$(curl -sS -o /dev/null -w '%{http_code}' \
|
|
-H "X-Vault-Token: ${TOKEN}" --data "$payload" \
|
|
"${ADDR}/v1/secret/data/gitea/push")"
|
|
case "$code" in
|
|
200|204) echo "stored secret/gitea/push (HTTP $code)";;
|
|
*) echo "FAILED storing secret (HTTP $code)"; exit 1;;
|
|
esac
|