openclaw-workspace-2026/scripts/vault-env.sh

#!/bin/bash
# vault-env.sh - Sourceable environment loader for Vault secrets
#
# PURPOSE: Provides shell functions to quickly access cached Vault secrets
# without repeatedly querying Vault. Auto-fetches on first use.
#
# USAGE: source /path/to/vault-env.sh
#        vault_env_load <category> <service> [field]
#
# EXAMPLES:
#   source vault-env.sh
#   NOCODB_TOKEN=$(vault_env_get data nocodb api_token)
#   QDRANT_KEY=$(vault_env_get data qdrant api_key)
#
#   # Or load all variables from a service:
#   eval $(vault_env_export data nocodb)

VAULT_CACHE_DIR="${HOME}/.cache/vault"
VAULT_CACHE_SCRIPT="${HOME}/.openclaw/workspace/scripts/vault-cache.sh"

# Ensure cache is available
vault_env_init() {
    if [[ ! -d "$VAULT_CACHE_DIR" ]]; then
        if [[ -x "$VAULT_CACHE_SCRIPT" ]]; then
            "$VAULT_CACHE_SCRIPT" sync >/dev/null 2>&1
        fi
    fi
}

# Get a specific field value from a service
# Usage: vault_env_get <category> <service> <field>
# Example: vault_env_get data nocodb api_token
vault_env_get() {
    local category="$1"
    local service="$2"
    local field="$3"
    local path="api/${category}/${service}"
    
    vault_env_init
    
    # Try cache first, fall back to vault-cache.sh get (which auto-fetches)
    if [[ -x "$VAULT_CACHE_SCRIPT" ]]; then
        "$VAULT_CACHE_SCRIPT" get "$path" "$field"
    else
        echo "ERROR: vault-cache.sh not found" >&2
        return 1
    fi
}

# Export all fields from a service as shell variables
# Usage: eval $(vault_env_export <category> <service> [prefix])
# Example: eval $(vault_env_export data nocodb NOCODB_)
# Result: Sets NOCODB_API_TOKEN, NOCODB_TABLE_ID, etc.
vault_env_export() {
    local category="$1"
    local service="$2"
    local prefix="${3:-$(echo "$service" | tr '[:lower:]' '[:upper:]' | tr '-' '_')_}"
    local path="api/${category}/${service}"
    
    vault_env_init
    
    if [[ ! -x "$VAULT_CACHE_SCRIPT" ]]; then
        echo "# ERROR: vault-cache.sh not found" >&2
        return 1
    fi
    
    local json
    json=$("$VAULT_CACHE_SCRIPT" get "$path")
    
    # Check if we got a JSON response or key:value lines
    if echo "$json" | head -1 | grep -q ': '; then
        # It's key:value format, convert to proper export statements
        echo "$json" | while IFS=': ' read -r key value; do
            [[ -z "$key" ]] && continue
            local var_name="${prefix}$(echo "$key" | tr '[:lower:]' '[:upper:]' | tr '-' '_')"
            # Only export simple string values, skip complex JSON
            if [[ ! "$value" == '{'* ]] && [[ -n "$value" ]]; then
                echo "export ${var_name}=$(printf '%q' "$value")"
            fi
        done
    else
        echo "$json" | jq -r 'to_entries | .[] | "export '"${prefix}"'\(.key | ascii_upcase | gsub("-"; "_"))=\(.value | @sh)"'
    fi
}

# Quick access functions for commonly used services
# Usage: source this file, then call these directly

# NocoDB
vault_nocodb_token() { vault_env_get data nocodb api_token; }
vault_nocodb_table_id() { vault_env_get data nocodb table-id; }
vault_nocodb_url() { vault_env_get data nocodb internal_url; }

# Qdrant
vault_qdrant_api_key() { vault_env_get data qdrant api_key; }
vault_qdrant_url() { vault_env_get data qdrant base_url; }

# Metabase
vault_metabase_password() { vault_env_get data metabase password; }

# rustfs/S3
vault_rustfs_secret_key() { vault_env_get data rustfs secret-key; }
vault_rustfs_access_key() { vault_env_get data rustfs access-key; }

# Grist
vault_grist_token() { vault_env_get business grist token; }

# Gitea
vault_gitea_token() { vault_env_get business gitea token; }

# Odoo
vault_odoo_api_key() { vault_env_get infrastructure odoo api-key; }

# SSH Keys
vault_ssh_ed25519_private() { vault_env_get infrastructure ssh ssh-ed25519-private-key; }
vault_ssh_cloudbox_private() { vault_env_get infrastructure ssh ssh-cloudbox-private-key; }

# N8N
vault_n8n_api_key() { vault_env_get communication n8n api_key; }
vault_n8n_url() { vault_env_get communication n8n base_url; }

# Ollama
vault_ollama_api_key() { vault_env_get research ollama api_key; }

# UptimeKuma
vault_uptimekuma_token() { vault_env_get infrastructure uptimekuma token; }

# Initialize on source
vault_env_init

# If this script is being executed (not sourced), show help
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
    echo "Vault Environment Loader"
    echo ""
    echo "Source this file to load helper functions:"
    echo "  source vault-env.sh"
    echo ""
    echo "Functions:"
    echo "  vault_env_get <category> <service> <field>     Get specific value"
    echo "  vault_env_export <category> <service> [prefix]  Export all fields as vars"
    echo ""
    echo "Quick accessors:"
    echo "  vault_nocodb_token        vault_qdrant_api_key"
    echo "  vault_grist_token         vault_odoo_api_key"
    echo "  vault_n8n_api_key         vault_ollama_api_key"
    echo "  vault_gitea_token         vault_metabase_password"
    echo "  vault_ssh_ed25519_private vault_ssh_cloudbox_private"
    echo ""
    echo "Examples:"
    echo '  TOKEN=$(vault_nocodb_token)'
    echo '  eval $(vault_env_export data nocodb NOCODB_)'
fi