start project

scripts/generate_secrets.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# =============================================================================
+# Replaces every "change-me..." placeholder in .env with a freshly generated
+# secret.
+#
+# config/settings/prod.py refuses to start on a placeholder value, so this is
+# what makes the very first `make up` both work and be safe: nobody ends up
+# running a real deployment on the credentials published in .env.example.
+#
+#   scripts/generate_secrets.sh [path-to-env]   (default: .env)
+#
+# Only placeholders are touched - a value you have already set is left alone,
+# so re-running this is safe and never invalidates working credentials.
+# =============================================================================
+set -Eeuo pipefail
+
+ENV_FILE="${1:-.env}"
+
+[[ -f "${ENV_FILE}" ]] || { echo "No ${ENV_FILE} to update." >&2; exit 1; }
+
+# `openssl rand -base64` is available anywhere Docker is; tr strips the
+# characters that would need quoting inside a URL-shaped DATABASE_URL.
+random() { openssl rand -base64 48 | tr -d '\n=+/' | cut -c1-"${1:-50}"; }
+
+changed=0
+for key in DJANGO_SECRET_KEY POSTGRES_PASSWORD ELASTIC_PASSWORD; do
+  current="$(grep -E "^${key}=" "${ENV_FILE}" | head -1 | cut -d= -f2- || true)"
+
+  case "${current,,}" in
+    *change-me*|*changeme*|'')
+      # 64 chars for the signing key (prod.py enforces >= 50), 32 for the
+      # service passwords.
+      length=32
+      [[ "${key}" == "DJANGO_SECRET_KEY" ]] && length=64
+      value="$(random "${length}")"
+      # `|` as the sed delimiter: generated values never contain it.
+      sed -i "s|^${key}=.*|${key}=${value}|" "${ENV_FILE}"
+      echo "  generated ${key}"
+      changed=1
+      ;;
+    *)
+      echo "  kept ${key} (already set)"
+      ;;
+  esac
+done
+
+if [[ "${changed}" -eq 1 ]]; then
+  echo "Secrets written to ${ENV_FILE}. It is gitignored - back it up somewhere safe."
+fi