42 lines
1.4 KiB
Bash
Executable File
42 lines
1.4 KiB
Bash
Executable File
#!/bin/sh
|
|
set -e
|
|
|
|
mkdir -p /opt/spire/data/server
|
|
|
|
if [ ! -f /opt/spire/server.conf ]; then
|
|
echo "Writing default SPIRE server.conf..."
|
|
cp /etc/spire/templates/server.conf /opt/spire/server.conf
|
|
chmod 644 /opt/spire/server.conf
|
|
fi
|
|
|
|
# Launch SPIRE Server in background to allow auto-bootstrap token generation
|
|
/usr/local/bin/spire-server "$@" &
|
|
SERVER_PID=$!
|
|
|
|
# Helper: Maintain auto-bootstrap join token until local agent has successfully enrolled
|
|
(
|
|
SOCKET="/opt/spire/data/server/api.sock"
|
|
while [ ! -S "$SOCKET" ]; do
|
|
sleep 1
|
|
done
|
|
|
|
while [ ! -f /opt/spire/data/agent/svid.key ] && [ ! -f /opt/spire/data/agent/agent_svids.json ]; do
|
|
if [ ! -f /opt/spire/data/bootstrap_token ]; then
|
|
echo "[SPIRE Server] Generating auto-bootstrap join token for local agent..."
|
|
TOKEN_OUTPUT=$(/usr/local/bin/spire-server token generate -spiffeID spiffe://system.local/agent -socketPath "$SOCKET" -ttl 3600 2>/dev/null || true)
|
|
TOKEN=$(echo "$TOKEN_OUTPUT" | grep -i "token:" | awk '{print $2}')
|
|
if [ -n "$TOKEN" ]; then
|
|
echo "$TOKEN" > /opt/spire/data/bootstrap_token
|
|
chmod 600 /opt/spire/data/bootstrap_token
|
|
echo "[SPIRE Server] Auto-bootstrap token ready."
|
|
fi
|
|
fi
|
|
sleep 5
|
|
done
|
|
|
|
echo "[SPIRE Server] Agent enrollment verified. Cleaning up bootstrap tokens."
|
|
rm -f /opt/spire/data/bootstrap_token
|
|
) &
|
|
|
|
wait "$SERVER_PID"
|