From c23c8d1a881e0153e6ecc6d6ed67d6034cfbe00a Mon Sep 17 00:00:00 2001 From: Libby Date: Mon, 9 Nov 2026 15:52:48 +0000 Subject: [PATCH] deploy plan: NetworkTagSecret step checks openssl and treats an empty value as not set Co-Authored-By: Claude Sonnet 5.5 (cherry picked from commit 427390732493a8a23a5037790e78420bacc12dc2) --- docs/deploy-main-to-live.md | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/docs/deploy-main-to-live.md b/docs/deploy-main-to-live.md index 3d8cb57..dfe6d1b 100644 --- a/docs/deploy-main-to-live.md +++ b/docs/deploy-main-to-live.md @@ -144,11 +144,26 @@ Record the time and the output line of each in the deploy record. Stop at the fi `/srv/bifrost/env/bifrost.env`, after the timestamped backup, printing nothing. The secret is random, 32 or more characters, and is never echoed, logged or pasted into a chat. For example (`openssl rand -hex 32` gives 64 hex characters and nothing that needs quoting in a systemd `EnvironmentFile`): - `sudo -n sh -c 'umask 077; cd /srv/bifrost/env && if grep -q "^ConceptVotes__NetworkTagSecret=" bifrost.env; then echo "ConceptVotes__NetworkTagSecret already set, left unchanged"; else cp -a bifrost.env bifrost.env.pre- && { printf "\nConceptVotes__NetworkTagSecret="; openssl rand -hex 32 | tr -d "\n"; printf "\n"; } >> bifrost.env; fi && chown bifrost bifrost.env && chmod 600 bifrost.env'` - The guard makes a re-run safe: an existing `ConceptVotes__NetworkTagSecret=` line is never overwritten or duplicated, and the - skip message prints no value. (If a duplicate key ever got in, systemd's `EnvironmentFile` takes the last one, so remove - the extra line by hand; do not leave two.) A present line shorter than 32 characters is not replaced by this command - either: fix it deliberately, with the rotation warning below in mind. + ``` + sudo -n sh -c 'umask 077; cd /srv/bifrost/env || exit 1 + if grep -Eq "^[[:space:]]*ConceptVotes__NetworkTagSecret=[^[:space:]]" bifrost.env; then + echo "ConceptVotes__NetworkTagSecret already set, left unchanged" + elif grep -Eq "^[[:space:]]*ConceptVotes__NetworkTagSecret=" bifrost.env; then + echo "ConceptVotes__NetworkTagSecret present with an empty value: fix by hand, nothing appended"; exit 1 + else + v=$(openssl rand -hex 32) || { echo "openssl failed, nothing appended"; exit 1; } + [ "${#v}" -ge 32 ] || { echo "generated value shorter than 32, nothing appended"; exit 1; } + cp -a bifrost.env bifrost.env.pre- && printf "\nConceptVotes__NetworkTagSecret=%s\n" "$v" >> bifrost.env + fi && chown bifrost bifrost.env && chmod 600 bifrost.env' + ``` + The generated value is checked before anything is written: a failed `openssl`, or a value under 32 characters, appends + nothing. The guard makes a re-run safe: an existing `ConceptVotes__NetworkTagSecret=` line, with or without leading + spaces, is never overwritten or duplicated, and the skip message prints no value. A line with an empty (or + whitespace-only) value counts as not set and is reported, not repaired: the command stops with a message and the + operator fixes the line by hand (an empty value would otherwise sit beside a new one; systemd's `EnvironmentFile` takes + the last duplicate, so do not leave two). A present line shorter than 32 characters is likewise not replaced by this + command: fix it deliberately, with the rotation warning below in mind. A commented-out line (`#`) is not a key and does + not count. (the same, with the value from the operator's own source, for `Heimdall__AppSecret`, which is not generated here). The file ends mode 600, owner `bifrost`, and the backup `bifrost.env.pre-` beside it keeps the old content. Re-run the name-only check after, and check the length by count only: