fintechner set admin password

06-set-admin-pass.sh

#!/bin/bash
# fintechner — set the dashboard admin password.
#
# Prompts for the password locally (no echo). Generates a bcrypt hash,
# stores ONLY the hash in AWS Secrets Manager, restarts the dashboard.
# The plaintext password never leaves the CloudShell process.

set -euo pipefail

REGION=ap-northeast-1
INSTANCE_ID=i-089ad4a6b76132ba2

if ! command -v htpasswd >/dev/null; then
  echo "Installing httpd-tools (provides htpasswd)..."
  sudo dnf install -y httpd-tools >/dev/null
fi

read -rs -p "New dashboard password: " P; echo
read -rs -p "Confirm:                 " P2; echo
if [ "$P" != "$P2" ]; then
  echo "Passwords don't match."
  exit 1
fi
if [ ${#P} -lt 8 ]; then
  echo "Password must be at least 8 characters."
  exit 1
fi

HASH=$(htpasswd -nbBC 10 "" "$P")
HASH="${HASH#:}"
HASH="${HASH/'$2y'/'$2a'}"
unset P P2

aws --region "$REGION" secretsmanager put-secret-value \
  --secret-id fintechner/admin-password \
  --secret-string "$HASH" >/dev/null
echo "Hash stored in Secrets Manager."

aws --region "$REGION" ssm send-command \
  --instance-ids "$INSTANCE_ID" \
  --document-name AWS-RunShellScript \
  --parameters 'commands=["sudo systemctl restart fintechner-dashboard"]' \
  --query Command.CommandId --output text >/dev/null
echo "Dashboard restarted."
echo
echo "You can now log in at https://13-193-136-150.sslip.io with:"
echo "  username: admin"
echo "  password: (the one you just typed)"

unset HASH