GameCult/Bifrost
Watch
9
0
Fork
You've already forked Bifrost
 0
Code Issues 7 Pull requests 5 Projects Releases Packages Wiki Activity Actions

deploy plan: NetworkTagSecret step checks openssl and treats an empty value as not set

Browse source 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
Libby 2026-11-09 15:52:48 +00:00
commit 4273907324
1 changed files with 20 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

25
docs/deploy-main-to-live.md
View file

@ -144,11 +144,26 @@ Record the time and the output line of each in the deploy record. Stop at the fi
`/srv/bifrost/env/bifrost.env`, after the timestamped backup, printing nothing. The secret is random, 32 or more
characters, and is never echoed, logged or pasted into a chat. For example (`openssl rand -hex 32` gives 64 hex
characters and nothing that needs quoting in a systemd `EnvironmentFile`):
`sudo -n sh -c 'umask 077; cd /srv/bifrost/env && if grep -q "^ConceptVotes__NetworkTagSecret=" bifrost.env; then echo "ConceptVotes__NetworkTagSecret already set, left unchanged"; else cp -a bifrost.env bifrost.env.pre-<UTC> && { printf "\nConceptVotes__NetworkTagSecret="; openssl rand -hex 32 | tr -d "\n"; printf "\n"; } >> bifrost.env; fi && chown bifrost bifrost.env && chmod 600 bifrost.env'`
The guard makes a re-run safe: an existing `ConceptVotes__NetworkTagSecret=` line is never overwritten or duplicated, and the
skip message prints no value. (If a duplicate key ever got in, systemd's `EnvironmentFile` takes the last one, so remove
the extra line by hand; do not leave two.) A present line shorter than 32 characters is not replaced by this command
either: fix it deliberately, with the rotation warning below in mind.
```
sudo -n sh -c 'umask 077; cd /srv/bifrost/env || exit 1
if grep -Eq "^[[:space:]]*ConceptVotes__NetworkTagSecret=[^[:space:]]" bifrost.env; then
echo "ConceptVotes__NetworkTagSecret already set, left unchanged"
elif grep -Eq "^[[:space:]]*ConceptVotes__NetworkTagSecret=" bifrost.env; then
echo "ConceptVotes__NetworkTagSecret present with an empty value: fix by hand, nothing appended"; exit 1
else
v=$(openssl rand -hex 32) || { echo "openssl failed, nothing appended"; exit 1; }
[ "${#v}" -ge 32 ] || { echo "generated value shorter than 32, nothing appended"; exit 1; }
cp -a bifrost.env bifrost.env.pre-<UTC> && printf "\nConceptVotes__NetworkTagSecret=%s\n" "$v" >> bifrost.env
fi && chown bifrost bifrost.env && chmod 600 bifrost.env'
```
The generated value is checked before anything is written: a failed `openssl`, or a value under 32 characters, appends
nothing. The guard makes a re-run safe: an existing `ConceptVotes__NetworkTagSecret=` line, with or without leading
spaces, is never overwritten or duplicated, and the skip message prints no value. A line with an empty (or
whitespace-only) value counts as not set and is reported, not repaired: the command stops with a message and the
operator fixes the line by hand (an empty value would otherwise sit beside a new one; systemd's `EnvironmentFile` takes
the last duplicate, so do not leave two). A present line shorter than 32 characters is likewise not replaced by this
command: fix it deliberately, with the rotation warning below in mind. A commented-out line (`#`) is not a key and does
not count.
(the same, with the value from the operator's own source, for `Heimdall__AppSecret`, which is not generated here).
The file ends mode 600, owner `bifrost`, and the backup `bifrost.env.pre-<UTC>` beside it keeps the old content.
Re-run the name-only check after, and check the length by count only: