47 lines
2.1 KiB
Bash
47 lines
2.1 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
repo_root=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
|
|
test_dir=$(mktemp -d)
|
|
trap 'rm -rf -- "$test_dir"' EXIT
|
|
|
|
install -d "$test_dir/env" "$test_dir/.komodo"
|
|
cp -- "$repo_root/docker-compose.yml" "$test_dir/docker-compose.yml"
|
|
cp -- "$repo_root/docker-compose.override.yml" "$test_dir/docker-compose.override.yml"
|
|
cp -- "$repo_root/env/common.env" "$test_dir/env/common.env"
|
|
|
|
cat > "$test_dir/.komodo/prod.env" <<'EOF'
|
|
PG_PASS=SENTINEL_POSTGRES_PASSWORD
|
|
AUTHENTIK_SECRET_KEY=SENTINEL_AUTHENTIK_SECRET_KEY
|
|
AUTHENTIK_EMAIL__PASSWORD=SENTINEL_EMAIL_PASSWORD
|
|
GEOIPUPDATE_LICENSE_KEY=SENTINEL_GEOIP_LICENSE_KEY
|
|
EOF
|
|
|
|
(
|
|
cd "$test_dir"
|
|
docker compose \
|
|
--env-file env/common.env \
|
|
--env-file .komodo/prod.env \
|
|
--file docker-compose.yml \
|
|
--file docker-compose.override.yml \
|
|
config --format json
|
|
) > "$test_dir/rendered.json"
|
|
|
|
if grep -F 'SENTINEL_' "$test_dir/rendered.json"; then
|
|
printf 'Rendered Compose configuration contains plaintext secrets\n' >&2
|
|
exit 1
|
|
fi
|
|
|
|
jq -e '
|
|
.services.postgresql.environment.POSTGRES_PASSWORD_FILE == "/run/secrets/postgres_password" and
|
|
(.services.postgresql.environment | has("POSTGRES_PASSWORD") | not) and
|
|
.services.server.environment.AUTHENTIK_POSTGRESQL__PASSWORD == "file:///run/secrets/postgres_password" and
|
|
.services.server.environment.AUTHENTIK_SECRET_KEY == "file:///run/secrets/authentik_secret_key" and
|
|
.services.server.environment.AUTHENTIK_EMAIL__PASSWORD == "file:///run/secrets/authentik_email_password" and
|
|
.services.geoipupdate.environment.GEOIPUPDATE_LICENSE_KEY_FILE == "/run/secrets/geoip_license_key" and
|
|
([.services.postgresql.secrets[].source] | sort) == ["postgres_password"] and
|
|
([.services.server.secrets[].source] | sort) == ["authentik_email_password", "authentik_secret_key", "postgres_password"] and
|
|
([.services.worker.secrets[].source] | sort) == ["authentik_email_password", "authentik_secret_key", "postgres_password"] and
|
|
([.services.geoipupdate.secrets[].source] | sort) == ["geoip_license_key"] and
|
|
(.services.redis | has("secrets") | not)
|
|
' "$test_dir/rendered.json" >/dev/null
|