fintechner restore connector env

22-restore-env.sh

#!/bin/bash
# fintechner — rewrite /etc/fintechner/connector.env from Secrets Manager
# after the hardening script clobbered it.

set -euo pipefail
export AWS_PAGER=""
REGION=ap-northeast-1
INSTANCE_ID=i-089ad4a6b76132ba2
ADMIN_EMAIL="koliadych@gmail.com"

echo "=== Fetching secrets ==="
DB_PWD=$(aws --region "$REGION" secretsmanager get-secret-value \
  --secret-id fintechner/db-password --query SecretString --output text)
MEK=$(aws --region "$REGION" secretsmanager get-secret-value \
  --secret-id fintechner/master-encryption-key --query SecretString --output text)
[ -n "$DB_PWD" ] || { echo "FATAL: DB password missing from Secrets Manager"; exit 1; }
[ -n "$MEK" ] || { echo "FATAL: master encryption key missing from Secrets Manager"; exit 1; }
echo "  OK"

ENV=$(cat <<EOF
LOG_LEVEL=info
HTTP_ADDR=:8080
DATABASE_URL=postgres://fintechner:${DB_PWD}@127.0.0.1:5432/fintechner?sslmode=disable
MASTER_ENCRYPTION_KEY=${MEK}
ADMIN_EMAIL=${ADMIN_EMAIL}
EOF
)
ENV_B64=$(printf '%s' "$ENV" | base64 -w0)
unset DB_PWD MEK ENV

cat > /tmp/ssm-restore.json <<JSON
{
  "commands": [
    "echo '${ENV_B64}' | base64 -d | sudo tee /etc/fintechner/connector.env >/dev/null",
    "sudo chmod 600 /etc/fintechner/connector.env",
    "sudo systemctl reset-failed fintechner-connector",
    "sudo systemctl restart fintechner-connector",
    "sleep 6",
    "echo === connector status ===",
    "sudo systemctl is-active fintechner-connector",
    "echo === port 8080 ===",
    "sudo ss -tlnp | grep :8080 || echo NO-LISTENER",
    "echo === connector journal last 10 ===",
    "sudo journalctl -u fintechner-connector -n 10 --no-pager"
  ]
}
JSON

CMD_ID=$(aws --region "$REGION" ssm send-command \
  --instance-ids "$INSTANCE_ID" \
  --document-name AWS-RunShellScript \
  --parameters file:///tmp/ssm-restore.json \
  --query Command.CommandId --output text)
rm -f /tmp/ssm-restore.json

for i in $(seq 1 20); do
  sleep 4
  STATUS=$(aws --region "$REGION" ssm get-command-invocation --command-id "$CMD_ID" --instance-id "$INSTANCE_ID" --query Status --output text 2>/dev/null || echo Pending)
  case "$STATUS" in Success|Failed|Cancelled|TimedOut) echo "  $STATUS"; break ;; *) echo "  $STATUS";; esac
done
echo
aws --region "$REGION" ssm get-command-invocation --command-id "$CMD_ID" --instance-id "$INSTANCE_ID" --query StandardOutputContent --output text