forked from DevOps/deploy.stack
126 lines
3.9 KiB
Bash
126 lines
3.9 KiB
Bash
#!/usr/bin/env bash
|
||
#
|
||
# create-multi-keys.sh — 在 vm61 honcho 上批量创建 3 个客户端的 API key
|
||
#
|
||
# 用法:
|
||
# 1. 在 vm61 上: ./create-multi-keys.sh
|
||
# 2. 输出 3 个 key 文件到 ~/.honcho-keys/，chmod 600
|
||
# 3. scp 到对应客户端
|
||
#
|
||
# 前置:
|
||
# - honcho-api 容器跑着
|
||
# - AUTH_USE_AUTH=true + 管理员 token（honcho init 时生成）
|
||
# - workspace "home" 已存在
|
||
#
|
||
# ⚠️ 不要 echo key 到聊天。文件 chmod 600，scp 时 -p 保留权限。
|
||
|
||
set -euo pipefail
|
||
|
||
WORKSPACE="${HONCHO_WORKSPACE:-home}"
|
||
HONCHO_API="${HONCHO_API_URL:-http://10.0.0.1:8000}"
|
||
ADMIN_TOKEN_FILE="${HONCHO_ADMIN_TOKEN_FILE:-/root/.honcho-keys/admin.key}"
|
||
|
||
# 客户端清单: name:peer:device_hint
|
||
CLIENTS=(
|
||
"alpha:laodeng-mypc03:mypc03"
|
||
"beta:laodeng-govpc:gov-pc"
|
||
"gamma:laodeng-mac:macbook"
|
||
)
|
||
|
||
OUT_DIR="${OUT_DIR:-/root/.honcho-keys}"
|
||
mkdir -p "$OUT_DIR"
|
||
chmod 700 "$OUT_DIR"
|
||
|
||
if [[ ! -f "$ADMIN_TOKEN_FILE" ]]; then
|
||
echo "❌ 找不到 admin token: $ADMIN_TOKEN_FILE" >&2
|
||
echo " 把 honcho init 时生成的 admin token 写到该文件，chmod 600" >&2
|
||
exit 1
|
||
fi
|
||
|
||
ADMIN_TOKEN="$(cat "$ADMIN_TOKEN_FILE")"
|
||
|
||
echo "==> honcho: $HONCHO_API"
|
||
echo "==> workspace: $WORKSPACE"
|
||
echo "==> 输出目录: $OUT_DIR"
|
||
echo ""
|
||
|
||
for entry in "${CLIENTS[@]}"; do
|
||
IFS=':' read -r slug peer device <<< "$entry"
|
||
key_file="$OUT_DIR/${device}.key"
|
||
info_file="$OUT_DIR/${device}.json"
|
||
|
||
echo "--- [$device] peer=$peer ---"
|
||
|
||
# 检查 peer 是否已存在（幂等）
|
||
existing="$(curl -fsS -H "Authorization: Bearer *** "$HONCHO_API/v2/workspaces/$WORKSPACE/peers/$peer" 2>/dev/null || true)"
|
||
|
||
if [[ -n "$existing" && "$existing" != *"404"* ]]; then
|
||
echo " peer 已存在，跳过创建"
|
||
else
|
||
# 创建 peer
|
||
curl -fsS -X POST \
|
||
-H "Authorization: Bearer *** \
|
||
-H "Content-Type: application/json" \
|
||
-d "{\"name\":\"$peer\"}" \
|
||
"$HONCHO_API/v2/workspaces/$WORKSPACE/peers" \
|
||
| tee "$info_file.tmp" > /dev/null
|
||
mv "$info_file.tmp" "$info_file"
|
||
chmod 600 "$info_file"
|
||
echo " ✅ peer 已创建"
|
||
fi
|
||
|
||
# 创建 API key（每次新建，旧的不 revoke）
|
||
# honcho 的 key 创建 API 名称可能因版本不同，下面给常见两种尝试
|
||
key_resp="$(curl -fsS -X POST \
|
||
-H "Authorization: Bearer *** \
|
||
-H "Content-Type: application/json" \
|
||
-d "{\"name\":\"$peer\",\"scope\":\"peer:$peer\"}" \
|
||
"$HONCHO_API/v2/workspaces/$WORKSPACE/api-keys" 2>/dev/null || true)"
|
||
|
||
if [[ -z "$key_resp" ]]; then
|
||
# 备选 endpoint
|
||
key_resp="$(curl -fsS -X POST \
|
||
-H "Authorization: Bearer *** \
|
||
-H "Content-Type: application/json" \
|
||
-d "{\"name\":\"$peer\"}" \
|
||
"$HONCHO_API/v2/auth/keys 2>/dev/null || true)"
|
||
fi
|
||
|
||
if [[ -z "$key_resp" ]]; then
|
||
echo " ❌ 创建 key 失败，请检查 honcho API 版本" >&2
|
||
echo " 临时手动: honcho create user --workspace $WORKSPACE --name $peer" >&2
|
||
continue
|
||
fi
|
||
|
||
# 提取 token（兼容多种字段名）
|
||
token="$(echo "$key_resp" | python3 -c '
|
||
import json, sys
|
||
try:
|
||
d = json.load(sys.stdin)
|
||
print(d.get("token") or d.get("api_key") or d.get("key") or d.get("value") or "")
|
||
except Exception:
|
||
print("")
|
||
')"
|
||
|
||
if [[ -z "$token" ]]; then
|
||
echo " ❌ 无法从响应提取 token:"
|
||
echo "$key_resp" | head -c 500
|
||
echo ""
|
||
continue
|
||
fi
|
||
|
||
echo -n "$token" > "$key_file"
|
||
chmod 600 "$key_file"
|
||
echo " ✅ key 已写入: $key_file ($(wc -c < "$key_file") bytes)"
|
||
done
|
||
|
||
echo ""
|
||
echo "==> 完成。当前 keys:"
|
||
ls -la "$OUT_DIR"
|
||
echo ""
|
||
echo "下一步:"
|
||
echo " scp $OUT_DIR/mypc03.key mypc03:~/.honcho-keys/"
|
||
echo " scp $OUT_DIR/govpc.key govpc:~/.honcho-keys/"
|
||
echo " scp $OUT_DIR/mac.key macbook:~/.honcho-keys/"
|
||
echo ""
|
||
echo "⚠️ 不要 echo 这些 key 到聊天/日志/screenshot" |