foxhunt/terraform/runpod/generate_credentials.sh

#!/usr/bin/env bash
# Foxhunt - Runpod Credential Generation Script
# Generates a secure .env.runpod file with random credentials
#
# Usage: ./generate_credentials.sh

set -euo pipefail

# Colors for output
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

ENV_FILE=".env.runpod"

# Print header
echo "========================================"
echo "Foxhunt Runpod Credential Generator"
echo "========================================"
echo ""

# Check if .env.runpod already exists
if [[ -f "${ENV_FILE}" ]]; then
    echo -e "${YELLOW}WARNING: ${ENV_FILE} already exists!${NC}"
    echo ""
    read -p "Overwrite existing file? (yes/no): " CONFIRM
    if [[ "${CONFIRM}" != "yes" ]]; then
        echo "Cancelled. No changes made."
        exit 0
    fi
    echo ""
fi

# Prompt for Databento API key
echo -e "${BLUE}Enter your Databento API key:${NC}"
echo "(Get from: https://databento.com/)"
read -p "> " DATABENTO_API_KEY

if [[ -z "${DATABENTO_API_KEY}" ]]; then
    echo "ERROR: Databento API key is required"
    exit 1
fi

echo ""
echo "Generating random credentials..."
echo ""

# Generate random credentials
POSTGRES_PASSWORD=$(openssl rand -base64 32)
VAULT_TOKEN=$(openssl rand -base64 32)
JWT_SECRET=$(openssl rand -base64 64)

# Create .env.runpod file
cat > "${ENV_FILE}" <<EOF
# Foxhunt Runpod Credentials
# Generated: $(date -u +"%Y-%m-%d %H:%M:%S UTC")
#
# IMPORTANT: Keep this file secure!
#   - DO NOT commit to version control
#   - DO NOT share via Slack/Discord/email
#   - Store backup in 1Password or AWS Secrets Manager
#
# Upload to Runpod volume BEFORE deploying pods:
#   1. Deploy volume: tofu apply -target=runpod_network_volume.foxhunt_volume
#   2. Upload this file to volume as '.env' (via Runpod console or S3 API)
#   3. Deploy pod: tofu apply

# Database credentials
POSTGRES_PASSWORD="${POSTGRES_PASSWORD}"

# Vault token
VAULT_TOKEN="${VAULT_TOKEN}"

# Databento API key (for market data)
DATABENTO_API_KEY="${DATABENTO_API_KEY}"

# JWT secret (for authentication)
JWT_SECRET="${JWT_SECRET}"
EOF

# Set secure permissions
chmod 600 "${ENV_FILE}"

# Print success message
echo -e "${GREEN}✓ Credentials generated successfully!${NC}"
echo ""
echo "File created: ${ENV_FILE}"
echo "Permissions: $(stat -c %a "${ENV_FILE}" 2>/dev/null || stat -f %Lp "${ENV_FILE}" 2>/dev/null)"
echo ""

# Print credential details (lengths only, not values)
echo "Credential details:"
echo "  - POSTGRES_PASSWORD: ${#POSTGRES_PASSWORD} chars"
echo "  - VAULT_TOKEN: ${#VAULT_TOKEN} chars"
echo "  - DATABENTO_API_KEY: ${#DATABENTO_API_KEY} chars"
echo "  - JWT_SECRET: ${#JWT_SECRET} chars"
echo ""

# Validate credentials
echo "Running validation..."
if ./validate_credentials.sh "${ENV_FILE}" 2>/dev/null; then
    echo ""
    echo -e "${GREEN}✓ All validations passed!${NC}"
else
    echo ""
    echo -e "${YELLOW}⚠ Some validations failed. Review output above.${NC}"
fi

echo ""
echo "========================================"
echo "Next Steps"
echo "========================================"
echo ""
echo "1. Backup credentials securely:"
echo "   - Store ${ENV_FILE} in 1Password, LastPass, or AWS Secrets Manager"
echo "   - DO NOT commit to git (already gitignored)"
echo ""
echo "2. Deploy Runpod volume:"
echo "   cd /home/jgrusewski/Work/foxhunt/terraform/runpod"
echo "   tofu init"
echo "   tofu apply -target=runpod_network_volume.foxhunt_volume"
echo ""
echo "3. Upload ${ENV_FILE} to volume:"
echo "   - Go to: https://www.runpod.io/console/volumes"
echo "   - Click on 'foxhunt-data-volume'"
echo "   - Upload ${ENV_FILE} as '.env'"
echo ""
echo "4. Deploy pod:"
echo "   tofu apply"
echo ""
echo "5. Verify credentials loaded:"
echo "   ssh root@<PUBLIC_IP>"
echo "   echo \$POSTGRES_PASSWORD  # Should print password"
echo "   docker-compose ps         # All services should be 'Up'"
echo ""
echo "========================================"