mirror of
https://github.com/stack-auth/stack.git
synced 2026-06-04 21:04:37 +08:00
0c3be92195
<!-- Make sure you've read the CONTRIBUTING.md guidelines: https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md --> Conditionally generate secrets. This stops docker image from generating new secrets upon every restart. Originally reported in #578. This fix aims to resolve this issue. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Secret values can now be externally injected during startup without being overwritten. Pre-configured secrets are preserved instead of being regenerated. <sub>✏️ Tip: You can customize this high-level summary in your review settings.</sub> <!-- end of auto-generated comment: release notes by coderabbit.ai -->
113 lines
4.4 KiB
Bash
113 lines
4.4 KiB
Bash
#!/bin/bash
|
||
|
||
set -e
|
||
|
||
# ============= FORWARD MOCK OAUTH SERVER =============
|
||
|
||
# Start socat to forward port 32202 for mock-oauth-server if enabled
|
||
if [ "$STACK_FORWARD_MOCK_OAUTH_SERVER" = "true" ]; then
|
||
socat TCP-LISTEN:32202,fork,reuseaddr TCP:host.docker.internal:32202 &
|
||
fi
|
||
|
||
# ============= ENV VARS =============
|
||
|
||
export STACK_SEED_INTERNAL_PROJECT_PUBLISHABLE_CLIENT_KEY=${STACK_SEED_INTERNAL_PROJECT_PUBLISHABLE_CLIENT_KEY:-$(openssl rand -base64 32)}
|
||
export STACK_SEED_INTERNAL_PROJECT_SECRET_SERVER_KEY=${STACK_SEED_INTERNAL_PROJECT_SECRET_SERVER_KEY:-$(openssl rand -base64 32)}
|
||
export STACK_SEED_INTERNAL_PROJECT_SUPER_SECRET_ADMIN_KEY=${STACK_SEED_INTERNAL_PROJECT_SUPER_SECRET_ADMIN_KEY:-$(openssl rand -base64 32)}
|
||
|
||
export NEXT_PUBLIC_STACK_PROJECT_ID=internal
|
||
export NEXT_PUBLIC_STACK_PUBLISHABLE_CLIENT_KEY=${STACK_SEED_INTERNAL_PROJECT_PUBLISHABLE_CLIENT_KEY}
|
||
export STACK_SECRET_SERVER_KEY=${STACK_SEED_INTERNAL_PROJECT_SECRET_SERVER_KEY}
|
||
export STACK_SUPER_SECRET_ADMIN_KEY=${STACK_SEED_INTERNAL_PROJECT_SUPER_SECRET_ADMIN_KEY}
|
||
|
||
export NEXT_PUBLIC_BROWSER_STACK_DASHBOARD_URL=${NEXT_PUBLIC_STACK_DASHBOARD_URL}
|
||
export NEXT_PUBLIC_STACK_PORT_PREFIX=${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}
|
||
PORT_PREFIX=${NEXT_PUBLIC_STACK_PORT_PREFIX}
|
||
export NEXT_PUBLIC_SERVER_STACK_DASHBOARD_URL="http://localhost:${PORT_PREFIX}01"
|
||
export NEXT_PUBLIC_BROWSER_STACK_API_URL=${NEXT_PUBLIC_STACK_API_URL}
|
||
export NEXT_PUBLIC_SERVER_STACK_API_URL="http://localhost:${PORT_PREFIX}02"
|
||
export BACKEND_PORT=${BACKEND_PORT:-${PORT_PREFIX}02}
|
||
export DASHBOARD_PORT=${DASHBOARD_PORT:-${PORT_PREFIX}01}
|
||
|
||
export USE_INLINE_ENV_VARS=true
|
||
|
||
if [ -z "${NEXT_PUBLIC_STACK_SVIX_SERVER_URL}" ]; then
|
||
export NEXT_PUBLIC_STACK_SVIX_SERVER_URL=${STACK_SVIX_SERVER_URL}
|
||
fi
|
||
|
||
# ============= MIGRATIONS =============
|
||
|
||
if [ "$STACK_SKIP_MIGRATIONS" = "true" ]; then
|
||
echo "Skipping migrations."
|
||
else
|
||
echo "Running migrations..."
|
||
cd apps/backend
|
||
node dist/db-migrations.js migrate
|
||
cd ../..
|
||
fi
|
||
|
||
if [ "$STACK_SKIP_SEED_SCRIPT" = "true" ]; then
|
||
echo "Skipping seed script."
|
||
else
|
||
echo "Running seed script..."
|
||
cd apps/backend
|
||
node dist/db-migrations.js seed
|
||
cd ../..
|
||
fi
|
||
|
||
# ============= ENV VARS =============
|
||
|
||
# Create a working directory for our processed files
|
||
# This is necessary because we need to replace the env vars in all files and we might want to run the seed script multiple times with different env vars.
|
||
WORK_DIR="/tmp/processed"
|
||
mkdir -p "$WORK_DIR"
|
||
|
||
echo "Copying files to working directory..."
|
||
cp -vr /app/. "$WORK_DIR"/.
|
||
|
||
# Find all files in the apps directory that contain a STACK_ENV_VAR_SENTINEL and extract the unique sentinel strings.
|
||
echo "Finding unhandled sentinels..."
|
||
unhandled_sentinels=$(find "$WORK_DIR/apps" -type f -exec grep -l "STACK_ENV_VAR_SENTINEL" {} + | \
|
||
xargs grep -h "STACK_ENV_VAR_SENTINEL" | \
|
||
grep -o "STACK_ENV_VAR_SENTINEL[A-Z_]*" | \
|
||
sort -u | grep -v "^STACK_ENV_VAR_SENTINEL$")
|
||
|
||
# Choose an uncommon delimiter – here, we use the ASCII Unit Separator (0x1F)
|
||
delimiter=$(printf '\037')
|
||
|
||
echo "Replacing sentinels..."
|
||
for sentinel in $unhandled_sentinels; do
|
||
# The sentinel is like "STACK_ENV_VAR_SENTINEL_MY_VAR", so extract the env var name.
|
||
env_var=${sentinel#STACK_ENV_VAR_SENTINEL_}
|
||
|
||
# Get the corresponding environment variable value.
|
||
value="${!env_var}"
|
||
|
||
# If the env var is not set, skip replacement.
|
||
if [ -z "$value" ]; then
|
||
continue
|
||
fi
|
||
|
||
# Although the sentinel only contains [A-Z_] we still escape it for any regex meta-characters.
|
||
escaped_sentinel=$(printf '%s\n' "$sentinel" | sed -e 's/\\/\\\\/g' -e 's/[][\/.^$*]/\\&/g')
|
||
|
||
# For the replacement value, first escape backslashes, then escape any occurrence of
|
||
# the chosen delimiter and the '&' (which has special meaning in sed replacements).
|
||
escaped_value=$(printf '%s\n' "$value" | sed -e 's/\\/\\\\/g' -e "s/[${delimiter}&]/\\\\&/g")
|
||
|
||
# Now replace the sentinel with the (properly escaped) value in all files in the working directory.
|
||
find $WORK_DIR/apps -type f -exec sed -i "s${delimiter}${escaped_sentinel}${delimiter}${escaped_value}${delimiter}g" {} +
|
||
done
|
||
|
||
# ============= START BACKEND AND DASHBOARD =============
|
||
|
||
echo "Starting backend on port $BACKEND_PORT..."
|
||
cd "$WORK_DIR"
|
||
PORT=$BACKEND_PORT HOSTNAME=0.0.0.0 node apps/backend/server.js &
|
||
|
||
echo "Starting dashboard on port $DASHBOARD_PORT..."
|
||
PORT=$DASHBOARD_PORT HOSTNAME=0.0.0.0 node apps/dashboard/server.js &
|
||
|
||
# Wait for both to finish
|
||
wait -n
|