From 1692395ffcab8ea0a7db2d3a1f5530c28ab8383c Mon Sep 17 00:00:00 2001
From: Martin Lablans <m.lablans@dkfz-heidelberg.de>
Date: Fri, 13 May 2022 14:11:14 +0200
Subject: [PATCH] Support retrieving credentials for vault from
 /etc/bridgehead/vault.conf

---
 bridgehead           |  2 +-
 lib/functions.sh     | 24 +++++++++++++++++++++++-
 lib/prerequisites.sh |  7 +++++++
 3 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/bridgehead b/bridgehead
index 7585594..bb02c92 100755
--- a/bridgehead
+++ b/bridgehead
@@ -46,7 +46,7 @@ source /etc/bridgehead/site.conf
 case "$ACTION" in
 	start)
 		checkRequirements
-		fetchVarsFromVault /etc/bridgehead/site.conf /etc/bridgehead/$PROJECT.env
+		fetchVarsFromVault /etc/bridgehead/site.conf /etc/bridgehead/$PROJECT.env || exit 1
 		exec docker-compose -f ./$PROJECT/docker-compose.yml --env-file /etc/bridgehead/$PROJECT.env up
 		;;
 	stop)
diff --git a/lib/functions.sh b/lib/functions.sh
index 751ce8e..e0a8b61 100755
--- a/lib/functions.sh
+++ b/lib/functions.sh
@@ -37,7 +37,29 @@ fetchVarsFromVault() {
 		return 0
 	fi
 
-	eval $(docker run --rm -ti -e BW_MASTERPASS -e BW_CLIENTID -e BW_CLIENTSECRET samply/bridgehead-vaultfetcher $VARS_TO_FETCH | sed 's/\r//g')
+	log INFO "Fetching secrets from vault ..."
+
+	[ -e /etc/bridgehead/vault.conf ] && source /etc/bridgehead/vault.conf
+
+	if [ -z "$BW_MASTERPASS" ] || [ -z "$BW_CLIENTID" ] || [ -z "$BW_CLIENTSECRET" ]; then
+		log ERROR "Please supply correct credentials in /etc/bridgehead/vault.conf."
+		return 1
+	fi
+
+	set +e
+
+	PASS=$(BW_MASTERPASS="$BW_MASTERPASS" BW_CLIENTID="$BW_CLIENTID" BW_CLIENTSECRET="$BW_CLIENTSECRET" docker run --rm -ti -e BW_MASTERPASS -e BW_CLIENTID -e BW_CLIENTSECRET samply/bridgehead-vaultfetcher $VARS_TO_FETCH)
+	RET=$?
+
+	if [ $RET -ne 0 ]; then
+		echo "Code: $RET"
+		echo $PASS
+		return $RET
+	fi
+
+	eval $(echo -e "$PASS" | sed 's/\r//g')
+
+	set -e
 
 	return 0
 }
diff --git a/lib/prerequisites.sh b/lib/prerequisites.sh
index 60fa945..983ebc3 100755
--- a/lib/prerequisites.sh
+++ b/lib/prerequisites.sh
@@ -69,6 +69,13 @@ if [ ! -e "certs/traefik.crt" ]; then
   openssl req -x509 -newkey rsa:4096 -nodes -keyout certs/traefik.key -out certs/traefik.crt -days 365
 fi
 
+if [ -e /etc/bridgehead/vault.conf ]; then
+	if [ "$(stat -c "%a %U" /etc/bridgehead/vault.conf)" != "600 bridgehead" ]; then
+		log ERROR "/etc/bridgehead/vault.conf has wrong owner/permissions. To correct this issue, run chmod 600 /etc/bridgehead/vault.conf && chown bridgehead /etc/bridgehead/vault.conf."
+		exit 1
+	fi
+fi
+
 log INFO "Success - all prerequisites are met!"
 
 exit 0