Implement Vault secret cache system
New scripts: - vault-cache.sh: Main cache manager (sync/get/list/status/invalidate) - vault-env.sh: Sourceable environment with quick accessor functions - vault-api-cached.sh: Drop-in replacement for vault_api.sh using cache - nocodb-api.sh: NocoDB API wrapper using cached token - qdrant-api.sh: Qdrant API wrapper using cached key - README-vault-cache.md: Documentation Updated scripts: - vault_grist_api.sh: Now uses vault cache - checks/check-memory-table.sh: Uses vault cache - utils/get-columns.sh: Uses vault cache - utils/update-type-col.sh: Uses vault cache Features: - 29 secrets cached from Vault (6 categories) - Auto-refresh on stale entries (1hr TTL) - Vault token cached for 24h - Restricted permissions (700/600) on cache files - Fallback to direct Vault API if cache miss
This commit is contained in:
JC Beasley
Executable
+152
@@ -0,0 +1,152 @@
|
||||
#!/bin/bash
|
||||
# vault-env.sh - Sourceable environment loader for Vault secrets
|
||||
#
|
||||
# PURPOSE: Provides shell functions to quickly access cached Vault secrets
|
||||
# without repeatedly querying Vault. Auto-fetches on first use.
|
||||
#
|
||||
# USAGE: source /path/to/vault-env.sh
|
||||
# vault_env_load <category> <service> [field]
|
||||
#
|
||||
# EXAMPLES:
|
||||
# source vault-env.sh
|
||||
# NOCODB_TOKEN=$(vault_env_get data nocodb api_token)
|
||||
# QDRANT_KEY=$(vault_env_get data qdrant api_key)
|
||||
#
|
||||
# # Or load all variables from a service:
|
||||
# eval $(vault_env_export data nocodb)
|
||||
|
||||
VAULT_CACHE_DIR="${HOME}/.cache/vault"
|
||||
VAULT_CACHE_SCRIPT="${HOME}/.openclaw/workspace/scripts/vault-cache.sh"
|
||||
|
||||
# Ensure cache is available
|
||||
vault_env_init() {
|
||||
if [[ ! -d "$VAULT_CACHE_DIR" ]]; then
|
||||
if [[ -x "$VAULT_CACHE_SCRIPT" ]]; then
|
||||
"$VAULT_CACHE_SCRIPT" sync >/dev/null 2>&1
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# Get a specific field value from a service
|
||||
# Usage: vault_env_get <category> <service> <field>
|
||||
# Example: vault_env_get data nocodb api_token
|
||||
vault_env_get() {
|
||||
local category="$1"
|
||||
local service="$2"
|
||||
local field="$3"
|
||||
local path="api/${category}/${service}"
|
||||
|
||||
vault_env_init
|
||||
|
||||
# Try cache first, fall back to vault-cache.sh get (which auto-fetches)
|
||||
if [[ -x "$VAULT_CACHE_SCRIPT" ]]; then
|
||||
"$VAULT_CACHE_SCRIPT" get "$path" "$field"
|
||||
else
|
||||
echo "ERROR: vault-cache.sh not found" >&2
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Export all fields from a service as shell variables
|
||||
# Usage: eval $(vault_env_export <category> <service> [prefix])
|
||||
# Example: eval $(vault_env_export data nocodb NOCODB_)
|
||||
# Result: Sets NOCODB_API_TOKEN, NOCODB_TABLE_ID, etc.
|
||||
vault_env_export() {
|
||||
local category="$1"
|
||||
local service="$2"
|
||||
local prefix="${3:-$(echo "$service" | tr '[:lower:]' '[:upper:]' | tr '-' '_')_}"
|
||||
local path="api/${category}/${service}"
|
||||
|
||||
vault_env_init
|
||||
|
||||
if [[ ! -x "$VAULT_CACHE_SCRIPT" ]]; then
|
||||
echo "# ERROR: vault-cache.sh not found" >&2
|
||||
return 1
|
||||
fi
|
||||
|
||||
local json
|
||||
json=$("$VAULT_CACHE_SCRIPT" get "$path")
|
||||
|
||||
# Check if we got a JSON response or key:value lines
|
||||
if echo "$json" | head -1 | grep -q ': '; then
|
||||
# It's key:value format, convert to proper export statements
|
||||
echo "$json" | while IFS=': ' read -r key value; do
|
||||
[[ -z "$key" ]] && continue
|
||||
local var_name="${prefix}$(echo "$key" | tr '[:lower:]' '[:upper:]' | tr '-' '_')"
|
||||
# Only export simple string values, skip complex JSON
|
||||
if [[ ! "$value" == '{'* ]] && [[ -n "$value" ]]; then
|
||||
echo "export ${var_name}=$(printf '%q' "$value")"
|
||||
fi
|
||||
done
|
||||
else
|
||||
echo "$json" | jq -r 'to_entries | .[] | "export '"${prefix}"'\(.key | ascii_upcase | gsub("-"; "_"))=\(.value | @sh)"'
|
||||
fi
|
||||
}
|
||||
|
||||
# Quick access functions for commonly used services
|
||||
# Usage: source this file, then call these directly
|
||||
|
||||
# NocoDB
|
||||
vault_nocodb_token() { vault_env_get data nocodb api_token; }
|
||||
vault_nocodb_table_id() { vault_env_get data nocodb table-id; }
|
||||
vault_nocodb_url() { vault_env_get data nocodb internal_url; }
|
||||
|
||||
# Qdrant
|
||||
vault_qdrant_api_key() { vault_env_get data qdrant api_key; }
|
||||
vault_qdrant_url() { vault_env_get data qdrant base_url; }
|
||||
|
||||
# Metabase
|
||||
vault_metabase_password() { vault_env_get data metabase password; }
|
||||
|
||||
# rustfs/S3
|
||||
vault_rustfs_secret_key() { vault_env_get data rustfs secret-key; }
|
||||
vault_rustfs_access_key() { vault_env_get data rustfs access-key; }
|
||||
|
||||
# Grist
|
||||
vault_grist_token() { vault_env_get business grist token; }
|
||||
|
||||
# Gitea
|
||||
vault_gitea_token() { vault_env_get business gitea token; }
|
||||
|
||||
# Odoo
|
||||
vault_odoo_api_key() { vault_env_get infrastructure odoo api-key; }
|
||||
|
||||
# SSH Keys
|
||||
vault_ssh_ed25519_private() { vault_env_get infrastructure ssh ssh-ed25519-private-key; }
|
||||
vault_ssh_cloudbox_private() { vault_env_get infrastructure ssh ssh-cloudbox-private-key; }
|
||||
|
||||
# N8N
|
||||
vault_n8n_api_key() { vault_env_get communication n8n api_key; }
|
||||
vault_n8n_url() { vault_env_get communication n8n base_url; }
|
||||
|
||||
# Ollama
|
||||
vault_ollama_api_key() { vault_env_get research ollama api_key; }
|
||||
|
||||
# UptimeKuma
|
||||
vault_uptimekuma_token() { vault_env_get infrastructure uptimekuma token; }
|
||||
|
||||
# Initialize on source
|
||||
vault_env_init
|
||||
|
||||
# If this script is being executed (not sourced), show help
|
||||
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
|
||||
echo "Vault Environment Loader"
|
||||
echo ""
|
||||
echo "Source this file to load helper functions:"
|
||||
echo " source vault-env.sh"
|
||||
echo ""
|
||||
echo "Functions:"
|
||||
echo " vault_env_get <category> <service> <field> Get specific value"
|
||||
echo " vault_env_export <category> <service> [prefix] Export all fields as vars"
|
||||
echo ""
|
||||
echo "Quick accessors:"
|
||||
echo " vault_nocodb_token vault_qdrant_api_key"
|
||||
echo " vault_grist_token vault_odoo_api_key"
|
||||
echo " vault_n8n_api_key vault_ollama_api_key"
|
||||
echo " vault_gitea_token vault_metabase_password"
|
||||
echo " vault_ssh_ed25519_private vault_ssh_cloudbox_private"
|
||||
echo ""
|
||||
echo "Examples:"
|
||||
echo ' TOKEN=$(vault_nocodb_token)'
|
||||
echo ' eval $(vault_env_export data nocodb NOCODB_)'
|
||||
fi
|
||||
Reference in New Issue
Block a user