setup-secrets.sh

#!/usr/bin/env zsh
# setup-secrets.sh — Generates all required .secrets/ files for local development.
# Run once: chmod +x setup-secrets.sh && ./setup-secrets.sh
# All values are randomly generated — change them if you need fixed passwords.

set -euo pipefail

SECRETS_DIR=".secrets"
mkdir -p "$SECRETS_DIR"

gen() {
  local name="$1"
  local value="$2"
  local path="$SECRETS_DIR/$name"
  if [[ -f "$path" ]]; then
    echo "  [skip] $name (already exists)"
  else
    printf '%s' "$value" > "$path"
    echo "  [ok]   $name"
  fi
}

rand() { openssl rand -base64 32 | tr -d '\n/+=' | cut -c1-32; }

echo "Generating secrets in ./$SECRETS_DIR/ ..."

# PostgreSQL
gen "postgres_password"                    "$(rand)"

# RabbitMQ
gen "RabbitMQ__Password"                   "$(rand)"

# Elasticsearch
gen "Elasticsearch__Password"              "$(rand)"
gen "kibana_system_password"               "$(rand)"
gen "kibana_encryption_key"                "$(openssl rand -base64 32 | tr -d '\n')"
gen "kibana_security_encryption_key"       "$(openssl rand -base64 32 | tr -d '\n')"
gen "kibana_reporting_encryption_key"      "$(openssl rand -base64 32 | tr -d '\n')"

# MinIO
gen "MinIO__AccessKey"                     "$(rand)"
gen "MinIO__SecretKey"                     "$(rand)"

# JWT
gen "Jwt__Secret"                          "$(openssl rand -base64 64 | tr -d '\n')"

# APM — same value in both files
APM_TOKEN="$(rand)"
gen "Apm__SecretToken"                     "$APM_TOKEN"
gen "Telemetry__ApmSecretToken"            "$APM_TOKEN"

# Connection string — built from postgres_password
PG_PASS="$(cat $SECRETS_DIR/postgres_password)"
PG_DB="${POSTGRES_DB:-cleanarcstack}"
PG_USER="${POSTGRES_USER:-postgres}"
gen "ConnectionStrings__DefaultConnection" \
    "Host=postgres;Port=5432;Database=$PG_DB;Username=$PG_USER;Password=$PG_PASS;"

echo ""
echo "Done. Keep .secrets/ out of Git (already in .gitignore)."
echo "Start everything with: docker compose up -d"