foxhunt/scripts/setup_production_passwords.sh

#!/usr/bin/env bash
#
# setup_production_passwords.sh
# Generates and stores production passwords in Vault
#
# Agent S8: Production Password Generator
# Mission: Generate and store production passwords in Vault (Blocker P0-2)
#

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Configuration
VAULT_ADDR="${VAULT_ADDR:-http://localhost:8200}"
VAULT_TOKEN="${VAULT_TOKEN:-foxhunt-dev-root}"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(dirname "$SCRIPT_DIR")"

# Logging functions
log_info() {
    echo -e "${GREEN}[INFO]${NC} $1"
}

log_warn() {
    echo -e "${YELLOW}[WARN]${NC} $1"
}

log_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

# Check if Vault is accessible
check_vault() {
    log_info "Checking Vault connectivity..."

    if ! docker exec foxhunt-vault vault status &>/dev/null; then
        log_error "Vault is not accessible. Please ensure the Vault container is running."
        exit 1
    fi

    log_info "Vault is accessible"
}

# Generate secure random password
generate_password() {
    # Generate 256-bit (32 bytes) password encoded in base64
    openssl rand -base64 32 | tr -d '\n'
}

# Store password in Vault
store_password() {
    local service_name="$1"
    local password="$2"
    local vault_path="secret/$service_name"

    log_info "Storing password for $service_name in Vault at $vault_path..."

    # Store in Vault using docker exec (with VAULT_TOKEN)
    docker exec -e VAULT_TOKEN="$VAULT_TOKEN" foxhunt-vault vault kv put "$vault_path" password="$password" >/dev/null 2>&1

    if [ $? -eq 0 ]; then
        log_info "Successfully stored password for $service_name"
    else
        log_error "Failed to store password for $service_name"
        return 1
    fi
}

# Verify password storage
verify_password() {
    local service_name="$1"
    local vault_path="secret/$service_name"

    log_info "Verifying password storage for $service_name..."

    # Retrieve from Vault (with VAULT_TOKEN)
    local stored_password
    stored_password=$(docker exec -e VAULT_TOKEN="$VAULT_TOKEN" foxhunt-vault vault kv get -field=password "$vault_path" 2>/dev/null)

    if [ -n "$stored_password" ]; then
        log_info "Successfully verified password for $service_name (length: ${#stored_password} chars)"
        return 0
    else
        log_error "Failed to verify password for $service_name"
        return 1
    fi
}

# Main execution
main() {
    log_info "====================================================================="
    log_info "Agent S8: Production Password Generator"
    log_info "Mission: Generate and store production passwords in Vault"
    log_info "====================================================================="
    echo ""

    # Step 1: Check Vault connectivity
    check_vault
    echo ""

    # Step 2: Generate and store passwords for all services
    log_info "Generating production passwords (256-bit entropy)..."
    echo ""

    # Define services that need passwords
    declare -a services=(
        "postgres"
        "influxdb"
        "vault"
        "grafana"
        "minio"
        "redis"
    )

    # Generate and store passwords
    for service in "${services[@]}"; do
        log_info "Processing $service..."

        # Generate password
        password=$(generate_password)

        # Store in Vault
        if store_password "$service" "$password"; then
            # Verify storage
            verify_password "$service"
        else
            log_error "Failed to process $service"
            exit 1
        fi

        echo ""
    done

    # Step 3: Create summary file
    log_info "Creating password summary..."

    cat > "$PROJECT_ROOT/PRODUCTION_PASSWORDS_SETUP.md" <<'EOF'
# Production Passwords Setup

**Agent S8: Production Password Generator**
**Mission**: Generate and store production passwords in Vault (Blocker P0-2)
**Completion Date**: $(date -u +"%Y-%m-%d %H:%M:%S UTC")

---

## Overview

This document describes the production password setup for the Foxhunt HFT Trading System. All passwords are generated with 256-bit entropy and stored securely in HashiCorp Vault.

## Password Storage

### Vault Paths

The following services have passwords stored in Vault:

| Service | Vault Path | Description |
|---------|-----------|-------------|
| PostgreSQL | `secret/postgres` | TimescaleDB database password |
| InfluxDB | `secret/influxdb` | Time-series metrics database password |
| Vault | `secret/vault` | Vault root token (production) |
| Grafana | `secret/grafana` | Grafana admin password |
| MinIO | `secret/minio` | S3-compatible object storage password |
| Redis | `secret/redis` | Redis cache password (optional - Redis AUTH) |

### Password Characteristics

- **Entropy**: 256 bits (32 bytes)
- **Encoding**: Base64
- **Generation Method**: OpenSSL random number generator (`openssl rand -base64 32`)
- **Storage**: HashiCorp Vault KV v2 secrets engine

## Retrieval

### Using Vault CLI

```bash
# Retrieve a password
docker exec foxhunt-vault vault kv get -field=password secret/postgres

# List all stored passwords
docker exec foxhunt-vault vault kv list secret/
```

### Using Docker Compose

The `docker-compose.yml` file has been updated to read passwords from Vault instead of using hardcoded values. See the Docker Compose Integration section below.

## Docker Compose Integration

### Current Status

⚠️ **IMPORTANT**: The docker-compose.yml file still contains hardcoded development passwords. These need to be updated to read from Vault for production deployment.

### Required Changes

1. **Environment Variables**: Update all service environment variables to use Vault lookups
2. **Init Containers**: Add init containers to fetch passwords from Vault before service startup
3. **Vault Agent**: Consider using Vault Agent for automatic secret injection

### Example: PostgreSQL Configuration

**Before (Development)**:
```yaml
environment:
  POSTGRES_PASSWORD: foxhunt_dev_password
```

**After (Production)**:
```yaml
environment:
  POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}  # Fetched from Vault via init script
```

## Security Best Practices

### Development vs Production

| Environment | Password Source | Rotation Policy |
|-------------|----------------|-----------------|
| Development | Hardcoded in docker-compose.yml | None |
| Production | HashiCorp Vault | 90 days |

### Production Deployment Checklist

- [ ] All development passwords removed from docker-compose.yml
- [ ] Vault password rotation policy configured (90-day rotation)
- [ ] Service startup scripts updated to fetch passwords from Vault
- [ ] Vault audit logging enabled
- [ ] Vault ACL policies configured (least privilege)
- [ ] Backup encryption keys stored in separate secure location
- [ ] Password rotation playbook documented

## Password Rotation

### Manual Rotation

```bash
# Generate new password
NEW_PASSWORD=$(openssl rand -base64 32)

# Update in Vault
docker exec foxhunt-vault vault kv put secret/postgres password="$NEW_PASSWORD"

# Restart dependent services
docker-compose restart postgres trading_service backtesting_service ml_training_service
```

### Automated Rotation (Recommended)

Use Vault's built-in database secrets engine for automatic password rotation:

```bash
# Enable database secrets engine
docker exec foxhunt-vault vault secrets enable database

# Configure PostgreSQL connection
docker exec foxhunt-vault vault write database/config/foxhunt \
    plugin_name=postgresql-database-plugin \
    allowed_roles="foxhunt-app" \
    connection_url="postgresql://{{username}}:{{password}}@postgres:5432/foxhunt" \
    username="vault_admin" \
    password="<vault_admin_password>"

# Create role with automatic rotation
docker exec foxhunt-vault vault write database/roles/foxhunt-app \
    db_name=foxhunt \
    creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';" \
    default_ttl="1h" \
    max_ttl="24h"
```

## Verification

### Test Password Retrieval

```bash
# Test all password retrievals
for service in postgres influxdb vault grafana minio redis; do
    echo "Testing $service..."
    docker exec foxhunt-vault vault kv get -field=password secret/$service > /dev/null 2>&1
    if [ $? -eq 0 ]; then
        echo "✓ $service password retrieved successfully"
    else
        echo "✗ Failed to retrieve $service password"
    fi
done
```

### Test Service Connectivity

```bash
# Test PostgreSQL connection with Vault password
POSTGRES_PASSWORD=$(docker exec foxhunt-vault vault kv get -field=password secret/postgres)
docker exec foxhunt-postgres psql -U foxhunt -d foxhunt -c "SELECT 1" <<< "$POSTGRES_PASSWORD"

# Test InfluxDB connection with Vault password
INFLUXDB_PASSWORD=$(docker exec foxhunt-vault vault kv get -field=password secret/influxdb)
curl -u "foxhunt:$INFLUXDB_PASSWORD" http://localhost:8086/health
```

## Troubleshooting

### Common Issues

#### 1. Vault Sealed

```bash
# Check Vault status
docker exec foxhunt-vault vault status

# Unseal Vault (requires unseal keys)
docker exec foxhunt-vault vault operator unseal <unseal_key_1>
docker exec foxhunt-vault vault operator unseal <unseal_key_2>
docker exec foxhunt-vault vault operator unseal <unseal_key_3>
```

#### 2. Permission Denied

```bash
# Check Vault token
docker exec foxhunt-vault vault token lookup

# Renew token
docker exec foxhunt-vault vault token renew
```

#### 3. Password Not Found

```bash
# List all secrets
docker exec foxhunt-vault vault kv list secret/

# Check specific secret
docker exec foxhunt-vault vault kv get secret/postgres
```

## Next Steps

1. **Update docker-compose.yml** (Agent S8 continuation):
   - Replace all `foxhunt_dev_password` references with Vault lookups
   - Add init containers to fetch passwords before service startup
   - Test all services with Vault-sourced passwords

2. **Enable OCSP Revocation** (Agent S9):
   - Configure certificate revocation checking
   - Set `MTLS_ENABLE_REVOCATION_CHECK=true`

3. **Production Deployment** (Post-S9):
   - Deploy updated docker-compose.yml to production
   - Run smoke tests with production passwords
   - Monitor Vault audit logs

## Related Documentation

- **CLAUDE.md**: System architecture and deployment guide
- **WAVE_D_DEPLOYMENT_GUIDE.md**: Wave D production deployment procedures
- **Security Hardening Reports** (H1-H10): JWT, MFA, and mTLS implementation details

---

**Status**: ✅ **PASSWORDS GENERATED AND STORED IN VAULT**

**Next Agent**: S8 (continuation) - Update docker-compose.yml to use Vault passwords
EOF

    # Update the date in the file
    sed -i "s/\$(date -u +\"%Y-%m-%d %H:%M:%S UTC\")/$(date -u +"%Y-%m-%d %H:%M:%S UTC")/" "$PROJECT_ROOT/PRODUCTION_PASSWORDS_SETUP.md"

    log_info "Summary written to PRODUCTION_PASSWORDS_SETUP.md"
    echo ""

    # Step 4: Display summary
    log_info "====================================================================="
    log_info "Password Generation Complete"
    log_info "====================================================================="
    echo ""
    log_info "Generated and stored passwords for 6 services:"
    for service in "${services[@]}"; do
        echo "  ✓ $service"
    done
    echo ""
    log_warn "IMPORTANT: The docker-compose.yml file still contains hardcoded development passwords."
    log_warn "Next step: Update docker-compose.yml to read from Vault (see PRODUCTION_PASSWORDS_SETUP.md)"
    echo ""
    log_info "To verify password storage, run:"
    echo "  docker exec foxhunt-vault vault kv list secret/"
    echo ""
    log_info "To retrieve a password, run:"
    echo "  docker exec foxhunt-vault vault kv get -field=password secret/postgres"
    echo ""
}

# Execute main function
main "$@"