cgalo5758
02bab9471b
Gate Stripe readiness on real credentials, surface dead-lettered syncs as failed with retry, and add header-safe toast JSON encoding. Switch the test Keycloak realm references to `test` and document the OpenSpec change.
69 lines
2.4 KiB
Bash
Executable File
69 lines
2.4 KiB
Bash
Executable File
#!/usr/bin/env sh
|
|
# Renders FedWiki identity fixtures into /data using real Keycloak UUIDs.
|
|
#
|
|
# Designed to run inside the `fedwiki-render` compose service (alpine/curl
|
|
# with jq + gettext installed at entrypoint). Reads templates from /seed,
|
|
# resolves UUIDs from the Keycloak admin API, writes rendered files to
|
|
# /data. Runs as root in-container, so no host file-ownership workaround.
|
|
#
|
|
# Required env: KC_URL, KC_REALM, KC_ADMIN_USER, KC_ADMIN_PASSWORD,
|
|
# KC_HOSTNAME, KEYCLOAK_PORT (browser-facing OIDC discovery host:port).
|
|
# Required mounts: /seed (test/seed/fedwiki, ro), /data (test/testdata/fedwiki).
|
|
|
|
set -eu
|
|
|
|
: "${KC_URL:?KC_URL must be set}"
|
|
# Admin auth against master; look up app users in the dedicated app realm.
|
|
: "${KC_ADMIN_REALM:=master}"
|
|
: "${KC_REALM:=test}"
|
|
: "${KC_ADMIN_USER:?KC_ADMIN_USER must be set}"
|
|
: "${KC_ADMIN_PASSWORD:?KC_ADMIN_PASSWORD must be set}"
|
|
# Browser-facing Keycloak host/port — rendered into config.json's oauth2_discoveryUrl
|
|
# so the OIDC endpoints Keycloak advertises match what the browser can reach.
|
|
: "${KC_HOSTNAME:?KC_HOSTNAME must be set}"
|
|
: "${KEYCLOAK_PORT:?KEYCLOAK_PORT must be set}"
|
|
export KC_HOSTNAME KEYCLOAK_PORT
|
|
|
|
echo "Fetching admin token from ${KC_URL}..."
|
|
TOKEN=$(curl -sf "${KC_URL}/realms/${KC_ADMIN_REALM}/protocol/openid-connect/token" \
|
|
-d "grant_type=password" \
|
|
-d "client_id=admin-cli" \
|
|
-d "username=${KC_ADMIN_USER}" \
|
|
-d "password=${KC_ADMIN_PASSWORD}" | jq -r '.access_token')
|
|
|
|
if [ -z "$TOKEN" ] || [ "$TOKEN" = "null" ]; then
|
|
echo "ERROR: failed to obtain Keycloak admin token" >&2
|
|
exit 1
|
|
fi
|
|
|
|
resolve_user_id() {
|
|
username="$1"
|
|
id=$(curl -sf -H "Authorization: Bearer ${TOKEN}" \
|
|
"${KC_URL}/admin/realms/${KC_REALM}/users?username=${username}&exact=true" \
|
|
| jq -r '.[0].id // empty')
|
|
if [ -z "$id" ]; then
|
|
echo "ERROR: user '${username}' not found in realm '${KC_REALM}' — keycloak-seed must run first" >&2
|
|
exit 1
|
|
fi
|
|
echo "$id"
|
|
}
|
|
|
|
ALICE_ID="$(resolve_user_id alice)"
|
|
export ALICE_ID
|
|
echo "Resolved alice -> ${ALICE_ID}"
|
|
|
|
echo "Rendering templates into /data/"
|
|
find /seed -type f -name '*.tpl' | while read -r tpl; do
|
|
rel="${tpl#/seed/}"
|
|
out="/data/${rel%.tpl}"
|
|
mkdir -p "$(dirname "$out")"
|
|
envsubst '${ALICE_ID} ${KC_HOSTNAME} ${KEYCLOAK_PORT}' < "$tpl" > "$out"
|
|
echo " rendered ${rel%.tpl}"
|
|
done
|
|
|
|
# Hand /data back to uid 1000 so the fedwiki container's `node` user
|
|
# can mkdir runtime subdirs (pages/, recycle/, ...).
|
|
chown -R 1000:1000 /data
|
|
|
|
echo "Done."
|