forked from DevOps/deploy.stack
126 lines
3.9 KiB
Bash
126 lines
3.9 KiB
Bash
|
#!/usr/bin/env bash
|
|||
|
|
#
|
|||
|
|
# create-multi-keys.sh — 在 vm61 honcho 上批量创建 3 个客户端的 API key
|
|||
|
|
#
|
|||
|
|
# 用法:
|
|||
|
|
# 1. 在 vm61 上: ./create-multi-keys.sh
|
|||
|
|
# 2. 输出 3 个 key 文件到 ~/.honcho-keys/，chmod 600
|
|||
|
|
# 3. scp 到对应客户端
|
|||
|
|
#
|
|||
|
|
# 前置:
|
|||
|
|
# - honcho-api 容器跑着
|
|||
|
|
# - AUTH_USE_AUTH=true + 管理员 token（honcho init 时生成）
|
|||
|
|
# - workspace "home" 已存在
|
|||
|
|
#
|
|||
|
|
# ⚠️ 不要 echo key 到聊天。文件 chmod 600，scp 时 -p 保留权限。
|
|||
|
|
|
|||
|
|
set -euo pipefail
|
|||
|
|
|
|||
|
|
WORKSPACE="${HONCHO_WORKSPACE:-home}"
|
|||
|
|
HONCHO_API="${HONCHO_API_URL:-http://10.0.0.1:8000}"
|
|||
|
|
ADMIN_TOKEN_FILE="${HONCHO_ADMIN_TOKEN_FILE:-/root/.honcho-keys/admin.key}"
|
|||
|
|
|
|||
|
|
# 客户端清单: name:peer:device_hint
|
|||
|
|
CLIENTS=(
|
|||
|
|
"alpha:laodeng-mypc03:mypc03"
|
|||
|
|
"beta:laodeng-govpc:gov-pc"
|
|||
|
|
"gamma:laodeng-mac:macbook"
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
OUT_DIR="${OUT_DIR:-/root/.honcho-keys}"
|
|||
|
|
mkdir -p "$OUT_DIR"
|
|||
|
|
chmod 700 "$OUT_DIR"
|
|||
|
|
|
|||
|
|
if [[ ! -f "$ADMIN_TOKEN_FILE" ]]; then
|
|||
|
|
echo "❌ 找不到 admin token: $ADMIN_TOKEN_FILE" >&2
|
|||
|
|
echo " 把 honcho init 时生成的 admin token 写到该文件，chmod 600" >&2
|
|||
|
|
exit 1
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
ADMIN_TOKEN="$(cat "$ADMIN_TOKEN_FILE")"
|
|||
|
|
|
|||
|
|
echo "==> honcho: $HONCHO_API"
|
|||
|
|
echo "==> workspace: $WORKSPACE"
|
|||
|
|
echo "==> 输出目录: $OUT_DIR"
|
|||
|
|
echo ""
|
|||
|
|
|
|||
|
|
for entry in "${CLIENTS[@]}"; do
|
|||
|
|
IFS=':' read -r slug peer device <<< "$entry"
|
|||
|
|
key_file="$OUT_DIR/${device}.key"
|
|||
|
|
info_file="$OUT_DIR/${device}.json"
|
|||
|
|
|
|||
|
|
echo "--- [$device] peer=$peer ---"
|
|||
|
|
|
|||
|
|
# 检查 peer 是否已存在（幂等）
|
|||
|
|
existing="$(curl -fsS -H "Authorization: Bearer *** "$HONCHO_API/v2/workspaces/$WORKSPACE/peers/$peer" 2>/dev/null || true)"
|
|||
|
|
|
|||
|
|
if [[ -n "$existing" && "$existing" != *"404"* ]]; then
|
|||
|
|
echo " peer 已存在，跳过创建"
|
|||
|
|
else
|
|||
|
|
# 创建 peer
|
|||
|
|
curl -fsS -X POST \
|
|||
|
|
-H "Authorization: Bearer *** \
|
|||
|
|
-H "Content-Type: application/json" \
|
|||
|
|
-d "{\"name\":\"$peer\"}" \
|
|||
|
|
"$HONCHO_API/v2/workspaces/$WORKSPACE/peers" \
|
|||
|
|
| tee "$info_file.tmp" > /dev/null
|
|||
|
|
mv "$info_file.tmp" "$info_file"
|
|||
|
|
chmod 600 "$info_file"
|
|||
|
|
echo " ✅ peer 已创建"
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
# 创建 API key（每次新建，旧的不 revoke）
|
|||
|
|
# honcho 的 key 创建 API 名称可能因版本不同，下面给常见两种尝试
|
|||
|
|
key_resp="$(curl -fsS -X POST \
|
|||
|
|
-H "Authorization: Bearer *** \
|
|||
|
|
-H "Content-Type: application/json" \
|
|||
|
|
-d "{\"name\":\"$peer\",\"scope\":\"peer:$peer\"}" \
|
|||
|
|
"$HONCHO_API/v2/workspaces/$WORKSPACE/api-keys" 2>/dev/null || true)"
|
|||
|
|
|
|||
|
|
if [[ -z "$key_resp" ]]; then
|
|||
|
|
# 备选 endpoint
|
|||
|
|
key_resp="$(curl -fsS -X POST \
|
|||
|
|
-H "Authorization: Bearer *** \
|
|||
|
|
-H "Content-Type: application/json" \
|
|||
|
|
-d "{\"name\":\"$peer\"}" \
|
|||
|
|
"$HONCHO_API/v2/auth/keys 2>/dev/null || true)"
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
if [[ -z "$key_resp" ]]; then
|
|||
|
|
echo " ❌ 创建 key 失败，请检查 honcho API 版本" >&2
|
|||
|
|
echo " 临时手动: honcho create user --workspace $WORKSPACE --name $peer" >&2
|
|||
|
|
continue
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
# 提取 token（兼容多种字段名）
|
|||
|
|
token="$(echo "$key_resp" | python3 -c '
|
|||
|
|
import json, sys
|
|||
|
|
try:
|
|||
|
|
d = json.load(sys.stdin)
|
|||
|
|
print(d.get("token") or d.get("api_key") or d.get("key") or d.get("value") or "")
|
|||
|
|
except Exception:
|
|||
|
|
print("")
|
|||
|
|
')"
|
|||
|
|
|
|||
|
|
if [[ -z "$token" ]]; then
|
|||
|
|
echo " ❌ 无法从响应提取 token:"
|
|||
|
|
echo "$key_resp" | head -c 500
|
|||
|
|
echo ""
|
|||
|
|
continue
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
echo -n "$token" > "$key_file"
|
|||
|
|
chmod 600 "$key_file"
|
|||
|
|
echo " ✅ key 已写入: $key_file ($(wc -c < "$key_file") bytes)"
|
|||
|
|
done
|
|||
|
|
|
|||
|
|
echo ""
|
|||
|
|
echo "==> 完成。当前 keys:"
|
|||
|
|
ls -la "$OUT_DIR"
|
|||
|
|
echo ""
|
|||
|
|
echo "下一步:"
|
|||
|
|
echo " scp $OUT_DIR/mypc03.key mypc03:~/.honcho-keys/"
|
|||
|
|
echo " scp $OUT_DIR/govpc.key govpc:~/.honcho-keys/"
|
|||
|
|
echo " scp $OUT_DIR/mac.key macbook:~/.honcho-keys/"
|
|||
|
|
echo ""
|
|||
|
|
echo "⚠️ 不要 echo 这些 key 到聊天/日志/screenshot"
|