47 lines
1.5 KiB
Ruby
47 lines
1.5 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
namespace 'migrate' do
|
|
desc 'Migrate api keys from vault secrets to transit'
|
|
task "26-api-keys": [:environment] do
|
|
puts 'Migrating API keys from secrets to transit keys (new in 2.6)'
|
|
APIKey.find_in_batches do |keys|
|
|
keys.each do |key|
|
|
legacy_key_path = "secret/barong/api_key/#{key.kid}"
|
|
secret = TOTPService.read_data(legacy_key_path)
|
|
next unless secret
|
|
|
|
value = secret.data[:value]
|
|
next unless value
|
|
|
|
key.secret = value
|
|
key.save!
|
|
TOTPService.delete_data(legacy_key_path)
|
|
end
|
|
end
|
|
end
|
|
|
|
desc 'Move TOTP secrets to include the vault application as prefix'
|
|
task "26-totp": [:environment] do
|
|
puts 'Moving TOTP secrets to include the vault application as prefix (new in 2.6)'
|
|
|
|
User.find_in_batches do |users|
|
|
users.each do |u|
|
|
legacy_key_path = "totp/keys/#{u.uid}"
|
|
legacy_export_path = "totp/export/#{u.uid}"
|
|
|
|
next unless TOTPService.read_data(legacy_key_path)
|
|
|
|
params = TOTPService.read_data(legacy_export_path)
|
|
unless params
|
|
raise "Failed to export key (#{legacy_export_path})\n"\
|
|
"Make sure vault is running with this image: quay.io/openware/vault:1.5.3-openware\n"\
|
|
'And make sure the token has read access to /totp/export/*'
|
|
end
|
|
key_path = TOTPService.totp_key(u.uid)
|
|
TOTPService.write_data(key_path, params.data.merge(generate: false))
|
|
TOTPService.delete_data(legacy_key_path)
|
|
end
|
|
end
|
|
end
|
|
end
|