fintechner bootstrap connector + admin user

14-bootstrap-and-start.sh

#!/bin/bash
# fintechner — final bootstrap: configure the connector + start it + seed admin.
#
# Generates MASTER_ENCRYPTION_KEY, fetches DB password, prompts for admin
# password, writes connector.env on EC2, starts connector, verifies.

set -euo pipefail
export AWS_PAGER=""

REGION=ap-northeast-1
INSTANCE_ID=i-089ad4a6b76132ba2
ADMIN_EMAIL="koliadych@gmail.com"

echo "=== 1. Prompt for admin password ==="
read -rs -p "Choose admin login password (12+ chars): " P; echo
read -rs -p "Confirm:                                  " P2; echo
if [ "$P" != "$P2" ]; then echo "Passwords don't match."; exit 1; fi
if [ ${#P} -lt 12 ]; then echo "Need 12+ chars."; exit 1; fi
unset P2

echo "=== 2. Generate / fetch MASTER_ENCRYPTION_KEY ==="
if ! aws --region "$REGION" secretsmanager get-secret-value \
  --secret-id fintechner/master-encryption-key >/dev/null 2>&1; then
  MEK=$(openssl rand -hex 32)
  aws --region "$REGION" secretsmanager create-secret \
    --name fintechner/master-encryption-key \
    --secret-string "$MEK" >/dev/null
  echo "  generated and stored in Secrets Manager."
fi
MEK=$(aws --region "$REGION" secretsmanager get-secret-value \
  --secret-id fintechner/master-encryption-key \
  --query SecretString --output text)

echo "=== 3. Fetch DB password ==="
DB_PWD=$(aws --region "$REGION" secretsmanager get-secret-value \
  --secret-id fintechner/db-password \
  --query SecretString --output text)

echo "=== 4. Write connector.env on EC2 + restart connector via SSM ==="
DB_URL="postgres://fintechner:${DB_PWD}@127.0.0.1:5432/fintechner?sslmode=disable"
ENV_BLOCK=$(cat <<EOF
LOG_LEVEL=info
HTTP_ADDR=:8080
DATABASE_URL=${DB_URL}
MASTER_ENCRYPTION_KEY=${MEK}
ADMIN_EMAIL=${ADMIN_EMAIL}
ADMIN_BOOTSTRAP_PASSWORD=${P}
EOF
)
unset P MEK DB_PWD DB_URL

# Use parameters as JSON file to avoid SSM escape mangling. Encode the env
# block as base64 so newlines survive transit cleanly.
ENV_B64=$(printf '%s' "$ENV_BLOCK" | base64 -w0)
unset ENV_BLOCK

cat > /tmp/ssm-bootstrap.json <<JSON
{
  "commands": [
    "echo '${ENV_B64}' | base64 -d | sudo tee /etc/fintechner/connector.env >/dev/null",
    "sudo chmod 600 /etc/fintechner/connector.env",
    "sudo systemctl reset-failed fintechner-connector",
    "sudo systemctl restart fintechner-connector",
    "sleep 8",
    "echo === connector status ===",
    "sudo systemctl is-active fintechner-connector",
    "echo === port 8080 ===",
    "sudo ss -tlnp | grep :8080 || echo NO-LISTENER-8080",
    "echo === tail journal ===",
    "sudo journalctl -u fintechner-connector -n 40 --no-pager",
    "echo === users in DB ===",
    "sudo docker exec timescale psql -U fintechner -d fintechner -c \"SELECT email, role FROM users;\" 2>&1 | head -10",
    "echo === restart dashboard so /api proxy retries ===",
    "sudo systemctl restart fintechner-dashboard"
  ]
}
JSON

CMD_ID=$(aws --region "$REGION" ssm send-command \
  --instance-ids "$INSTANCE_ID" \
  --document-name AWS-RunShellScript \
  --parameters file:///tmp/ssm-bootstrap.json \
  --query Command.CommandId --output text)
rm -f /tmp/ssm-bootstrap.json

echo "  ssm command: $CMD_ID"
for i in $(seq 1 30); do
  sleep 4
  STATUS=$(aws --region "$REGION" ssm get-command-invocation --command-id "$CMD_ID" --instance-id "$INSTANCE_ID" --query Status --output text 2>/dev/null || echo Pending)
  case "$STATUS" in Success|Failed|Cancelled|TimedOut) echo "  $STATUS"; break ;; *) echo "  $STATUS";; esac
done

echo
echo "=== STDOUT ==="
aws --region "$REGION" ssm get-command-invocation --command-id "$CMD_ID" --instance-id "$INSTANCE_ID" --query StandardOutputContent --output text
echo
echo "=== STDERR ==="
aws --region "$REGION" ssm get-command-invocation --command-id "$CMD_ID" --instance-id "$INSTANCE_ID" --query StandardErrorContent --output text

echo
echo "============================================================"
echo "Try logging in: https://13-193-136-150.sslip.io"
echo "  Email:    ${ADMIN_EMAIL}"
echo "  Password: (the one you typed at the start)"
echo "============================================================"