| 1 | #!/usr/bin/env bash |
| 2 | # Generate the Worker's own secrets once (never rotated automatically): |
| 3 | # MASTER_KEY root key for encrypting Actions secrets |
| 4 | # OIDC_PRIVATE_KEY ES256 key that signs workflow OIDC id tokens |
| 5 | # and, when missing, sets TURNSTILE_SECRET from the Turnstile widget whose site key was deployed |
| 6 | # (scripts/turnstile.sh, through bootstrap and render-config). |
| 7 | # Values are created on the runner (or read from Cloudflare's API) and sent straight to Cloudflare; |
| 8 | # they are never printed. |
| 9 | set -euo pipefail |
| 10 | ROOT="$(cd "$(dirname "$0")/.." && pwd)" |
| 11 | APP="$ROOT/apps/diffinery" |
| 12 | WRANGLER=(pnpm --dir "$APP" exec wrangler) |
| 13 | |
| 14 | # Fail closed: if listing fails we must not mistake "unknown" for "missing" and |
| 15 | # overwrite MASTER_KEY, which would make every stored Actions secret unreadable. |
| 16 | LIST="$("${WRANGLER[@]}" secret list -c wrangler.deploy.jsonc --format json)" |
| 17 | EXISTING="$(jq -er '.[].name' <<<"$LIST" || true)" |
| 18 | jq -e 'type == "array"' >/dev/null <<<"$LIST" || { echo "unexpected output from wrangler secret list" >&2; exit 1; } |
| 19 | |
| 20 | if ! grep -qx MASTER_KEY <<<"$EXISTING"; then |
| 21 | openssl rand -base64 32 | tr -d '\n' | "${WRANGLER[@]}" secret put MASTER_KEY -c wrangler.deploy.jsonc >/dev/null |
| 22 | echo "set MASTER_KEY" |
| 23 | fi |
| 24 | if ! grep -qx OIDC_PRIVATE_KEY <<<"$EXISTING"; then |
| 25 | node --input-type=module -e ' |
| 26 | const { subtle } = globalThis.crypto; |
| 27 | const k = await subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, ["sign", "verify"]); |
| 28 | const jwk = await subtle.exportKey("jwk", k.privateKey); |
| 29 | jwk.kid = "diffinery-" + new Date().toISOString().slice(0, 10); |
| 30 | process.stdout.write(JSON.stringify(jwk)); |
| 31 | ' | "${WRANGLER[@]}" secret put OIDC_PRIVATE_KEY -c wrangler.deploy.jsonc >/dev/null |
| 32 | echo "set OIDC_PRIVATE_KEY" |
| 33 | fi |
| 34 | # Without the Turnstile permission this warns (scripts/turnstile.sh names it) and the deploy goes on: |
| 35 | # people who aren't signed in can't send security reports until it's set. |
| 36 | SITE_KEY="$(tail -n +2 "$APP/wrangler.deploy.jsonc" | jq -r '.vars.TURNSTILE_SITE_KEY // empty')" |
| 37 | if [[ -n "$SITE_KEY" ]] && ! grep -qx TURNSTILE_SECRET <<<"$EXISTING"; then |
| 38 | if "$ROOT/scripts/turnstile.sh" secret "$SITE_KEY" -c wrangler.deploy.jsonc; then |
| 39 | echo "set TURNSTILE_SECRET" |
| 40 | else |
| 41 | echo "::warning::TURNSTILE_SECRET is not set, so only people who are signed in can send security reports. The next deploy tries again." >&2 |
| 42 | fi |
| 43 | fi |