Skip to content
This repository was archived by the owner on Jan 7, 2026. It is now read-only.

Commit 537e267

Browse files
CopilotStolas
Copilot
and
Stolas
committed
Add validation for required env variables with sane defaults
- Add read_var function with optional default value parameter - Add require_var function to track missing required variables - Validate required secrets (passwords/tokens) at startup - Abort with clear error message listing all missing variables - Use sane defaults for non-sensitive config (ports, hostnames, etc.) - Apply same defaults in check_first_run re-read section Co-authored-by: Stolas <610753+Stolas@users.noreply.github.com>
1 parent d7f1627 commit 537e267

File tree

1 file changed

+99
-42
lines changed

1 file changed

+99
-42
lines changed

‎startup.sh‎

Lines changed: 99 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -48,11 +48,38 @@ if [ ! -f "$ENV_FILE" ]; then
4848
fi
4949

5050
# --- Helper function to read variables from the secrets file ---
51+
# Usage: read_var VAR_NAME [DEFAULT_VALUE]
52+
# If DEFAULT_VALUE is provided and variable is empty/missing, returns the default
5153
read_var() {
54+
local var_name="$1"
55+
local default_value="$2"
56+
local value
5257
# The grep command handles the reading, removing potential leading/trailing spaces
53-
grep "^${1}=" "${ENV_FILE}" | cut -d'=' -f2- | tr -d '[:space:]'
58+
value=$(grep "^${var_name}=" "${ENV_FILE}" 2>/dev/null | cut -d'=' -f2- | tr -d '[:space:]')
59+
60+
if [ -z "$value" ] && [ -n "$default_value" ]; then
61+
echo "$default_value"
62+
else
63+
echo "$value"
64+
fi
65+
}
66+
67+
# --- Helper function to require a variable (abort if missing) ---
68+
# Usage: require_var VAR_NAME VAR_VALUE DESCRIPTION
69+
# Aborts execution if the variable is empty or missing
70+
require_var() {
71+
local var_name="$1"
72+
local var_value="$2"
73+
local description="$3"
74+
75+
if [ -z "$var_value" ]; then
76+
MISSING_VARS+=("${var_name} - ${description}")
77+
fi
5478
}
5579

80+
# Array to track missing required variables
81+
declare -a MISSING_VARS=()
82+
5683
# ----------------------------------------------------------------------
5784
# --- PODMAN SOCKET DETECTION AND VALIDATION ---
5885
# ----------------------------------------------------------------------
@@ -142,8 +169,9 @@ detect_podman_socket() {
142169
}
143170

144171
# --- Read variables for services and SMB mount ---
145-
FRIGATE_PORT=$(read_var FRIGATE_PORT)
146-
NODERED_PORT=$(read_var NODERED_PORT)
172+
# Variables with defaults (non-sensitive configuration)
173+
FRIGATE_PORT=$(read_var FRIGATE_PORT "5000")
174+
NODERED_PORT=$(read_var NODERED_PORT "1880")
147175
FRIGATE_RECORDINGS_HOST_PATH=$(read_var FRIGATE_RECORDINGS_HOST_PATH)
148176
SMB_SERVER=$(read_var SMB_SERVER)
149177
SMB_SHARE=$(read_var SMB_SHARE)
@@ -152,30 +180,59 @@ SMB_PASS=$(read_var SMB_PASS)
152180
ZIGBEE_DEVICE_PATH=$(read_var ZIGBEE_DEVICE_PATH)
153181
PODMAN_SOCKET_PATH=$(read_var PODMAN_SOCKET_PATH)
154182
CURRENT_UID=$(id -u)
155-
INFLUXDB_ADMIN_USER=$(read_var INFLUXDB_ADMIN_USER)
183+
INFLUXDB_ADMIN_USER=$(read_var INFLUXDB_ADMIN_USER "influx_admin")
156184
INFLUXDB_ADMIN_PASSWORD=$(read_var INFLUXDB_ADMIN_PASSWORD)
157-
INFLUXDB_ORG=$(read_var INFLUXDB_ORG)
158-
INFLUXDB_BUCKET=$(read_var INFLUXDB_BUCKET)
185+
INFLUXDB_ORG=$(read_var INFLUXDB_ORG "home_org")
186+
INFLUXDB_BUCKET=$(read_var INFLUXDB_BUCKET "iot_scada_data")
159187
INFLUXDB_ADMIN_TOKEN=$(read_var INFLUXDB_ADMIN_TOKEN)
160-
GRAFANA_ADMIN_USER=$(read_var GRAFANA_ADMIN_USER)
188+
GRAFANA_ADMIN_USER=$(read_var GRAFANA_ADMIN_USER "admin")
161189
GRAFANA_ADMIN_PASSWORD=$(read_var GRAFANA_ADMIN_PASSWORD)
162190
GRAFANA_SECRET_KEY=$(read_var GRAFANA_SECRET_KEY)
163-
GRAFANA_ANONYMOUS_ENABLED=$(read_var GRAFANA_ANONYMOUS_ENABLED)
164-
GRAFANA_ANONYMOUS_ORG_NAME=$(read_var GRAFANA_ANONYMOUS_ORG_NAME)
165-
GRAFANA_ANONYMOUS_ORG_ROLE=$(read_var GRAFANA_ANONYMOUS_ORG_ROLE)
166-
MQTT_USER=$(read_var MQTT_USER)
191+
GRAFANA_ANONYMOUS_ENABLED=$(read_var GRAFANA_ANONYMOUS_ENABLED "false")
192+
GRAFANA_ANONYMOUS_ORG_NAME=$(read_var GRAFANA_ANONYMOUS_ORG_NAME "Main Org.")
193+
GRAFANA_ANONYMOUS_ORG_ROLE=$(read_var GRAFANA_ANONYMOUS_ORG_ROLE "Viewer")
194+
MQTT_USER=$(read_var MQTT_USER "mqtt_user")
167195
MQTT_PASSWORD=$(read_var MQTT_PASSWORD)
168-
TZ=$(read_var TZ)
169-
BASE_DOMAIN=$(read_var BASE_DOMAIN)
170-
GRAFANA_HOSTNAME=$(read_var GRAFANA_HOSTNAME)
171-
FRIGATE_HOSTNAME=$(read_var FRIGATE_HOSTNAME)
172-
NODERED_HOSTNAME=$(read_var NODERED_HOSTNAME)
173-
ZIGBEE2MQTT_HOSTNAME=$(read_var ZIGBEE2MQTT_HOSTNAME)
174-
COCKPIT_HOSTNAME=$(read_var COCKPIT_HOSTNAME)
175-
DOUBLETAKE_HOSTNAME=$(read_var DOUBLETAKE_HOSTNAME)
176-
COMPREFACE_HOSTNAME=$(read_var COMPREFACE_HOSTNAME)
196+
TZ=$(read_var TZ "UTC")
197+
BASE_DOMAIN=$(read_var BASE_DOMAIN "home.local")
198+
GRAFANA_HOSTNAME=$(read_var GRAFANA_HOSTNAME "grafana")
199+
FRIGATE_HOSTNAME=$(read_var FRIGATE_HOSTNAME "frigate")
200+
NODERED_HOSTNAME=$(read_var NODERED_HOSTNAME "nodered")
201+
ZIGBEE2MQTT_HOSTNAME=$(read_var ZIGBEE2MQTT_HOSTNAME "zigbee")
202+
COCKPIT_HOSTNAME=$(read_var COCKPIT_HOSTNAME "cockpit")
203+
DOUBLETAKE_HOSTNAME=$(read_var DOUBLETAKE_HOSTNAME "doubletake")
204+
COMPREFACE_HOSTNAME=$(read_var COMPREFACE_HOSTNAME "compreface")
177205
COMPREFACE_API_KEY=$(read_var COMPREFACE_API_KEY)
178-
GO2RTC_HOSTNAME=$(read_var GO2RTC_HOSTNAME)
206+
GO2RTC_HOSTNAME=$(read_var GO2RTC_HOSTNAME "go2rtc")
207+
208+
# --- Validate required variables (passwords/secrets) ---
209+
# These are critical secrets that must be set - abort if missing
210+
require_var "MQTT_PASSWORD" "$MQTT_PASSWORD" "MQTT broker password"
211+
require_var "INFLUXDB_ADMIN_PASSWORD" "$INFLUXDB_ADMIN_PASSWORD" "InfluxDB admin password"
212+
require_var "INFLUXDB_ADMIN_TOKEN" "$INFLUXDB_ADMIN_TOKEN" "InfluxDB API token"
213+
require_var "GRAFANA_ADMIN_PASSWORD" "$GRAFANA_ADMIN_PASSWORD" "Grafana admin password"
214+
require_var "GRAFANA_SECRET_KEY" "$GRAFANA_SECRET_KEY" "Grafana secret key for sessions"
215+
216+
# Check if any required variables are missing and abort if so
217+
if [ ${#MISSING_VARS[@]} -gt 0 ]; then
218+
echo ""
219+
echo "================================================================"
220+
echo " MISSING REQUIRED CONFIGURATION "
221+
echo "================================================================"
222+
echo ""
223+
echo "ERROR: The following required variables are missing from ${ENV_FILE}:"
224+
echo ""
225+
for var in "${MISSING_VARS[@]}"; do
226+
echo " - $var"
227+
done
228+
echo ""
229+
echo "These are security-critical settings that must be configured."
230+
echo "Please edit ${ENV_FILE} and set all required values."
231+
echo ""
232+
echo "TIP: Run './create_secrets.sh' to auto-generate secure passwords."
233+
echo "================================================================"
234+
exit 1
235+
fi
179236

180237

181238
# ----------------------------------------------------------------------
@@ -847,10 +904,10 @@ check_first_run() {
847904
# First run - do configuration
848905
first_run_configuration
849906

850-
# Re-read variables after secrets are generated
907+
# Re-read variables after secrets are generated (with defaults for non-sensitive values)
851908
if [ -f "$ENV_FILE" ]; then
852-
FRIGATE_PORT=$(read_var FRIGATE_PORT)
853-
NODERED_PORT=$(read_var NODERED_PORT)
909+
FRIGATE_PORT=$(read_var FRIGATE_PORT "5000")
910+
NODERED_PORT=$(read_var NODERED_PORT "1880")
854911
FRIGATE_RECORDINGS_HOST_PATH=$(read_var FRIGATE_RECORDINGS_HOST_PATH)
855912
SMB_SERVER=$(read_var SMB_SERVER)
856913
SMB_SHARE=$(read_var SMB_SHARE)
@@ -859,30 +916,30 @@ check_first_run() {
859916
ZIGBEE_DEVICE_PATH=$(read_var ZIGBEE_DEVICE_PATH)
860917
PODMAN_SOCKET_PATH=$(read_var PODMAN_SOCKET_PATH)
861918
CURRENT_UID=$(id -u)
862-
INFLUXDB_ADMIN_USER=$(read_var INFLUXDB_ADMIN_USER)
919+
INFLUXDB_ADMIN_USER=$(read_var INFLUXDB_ADMIN_USER "influx_admin")
863920
INFLUXDB_ADMIN_PASSWORD=$(read_var INFLUXDB_ADMIN_PASSWORD)
864-
INFLUXDB_ORG=$(read_var INFLUXDB_ORG)
865-
INFLUXDB_BUCKET=$(read_var INFLUXDB_BUCKET)
921+
INFLUXDB_ORG=$(read_var INFLUXDB_ORG "home_org")
922+
INFLUXDB_BUCKET=$(read_var INFLUXDB_BUCKET "iot_scada_data")
866923
INFLUXDB_ADMIN_TOKEN=$(read_var INFLUXDB_ADMIN_TOKEN)
867-
GRAFANA_ADMIN_USER=$(read_var GRAFANA_ADMIN_USER)
924+
GRAFANA_ADMIN_USER=$(read_var GRAFANA_ADMIN_USER "admin")
868925
GRAFANA_ADMIN_PASSWORD=$(read_var GRAFANA_ADMIN_PASSWORD)
869926
GRAFANA_SECRET_KEY=$(read_var GRAFANA_SECRET_KEY)
870-
GRAFANA_ANONYMOUS_ENABLED=$(read_var GRAFANA_ANONYMOUS_ENABLED)
871-
GRAFANA_ANONYMOUS_ORG_NAME=$(read_var GRAFANA_ANONYMOUS_ORG_NAME)
872-
GRAFANA_ANONYMOUS_ORG_ROLE=$(read_var GRAFANA_ANONYMOUS_ORG_ROLE)
873-
MQTT_USER=$(read_var MQTT_USER)
927+
GRAFANA_ANONYMOUS_ENABLED=$(read_var GRAFANA_ANONYMOUS_ENABLED "false")
928+
GRAFANA_ANONYMOUS_ORG_NAME=$(read_var GRAFANA_ANONYMOUS_ORG_NAME "Main Org.")
929+
GRAFANA_ANONYMOUS_ORG_ROLE=$(read_var GRAFANA_ANONYMOUS_ORG_ROLE "Viewer")
930+
MQTT_USER=$(read_var MQTT_USER "mqtt_user")
874931
MQTT_PASSWORD=$(read_var MQTT_PASSWORD)
875-
TZ=$(read_var TZ)
876-
BASE_DOMAIN=$(read_var BASE_DOMAIN)
877-
GRAFANA_HOSTNAME=$(read_var GRAFANA_HOSTNAME)
878-
FRIGATE_HOSTNAME=$(read_var FRIGATE_HOSTNAME)
879-
NODERED_HOSTNAME=$(read_var NODERED_HOSTNAME)
880-
ZIGBEE2MQTT_HOSTNAME=$(read_var ZIGBEE2MQTT_HOSTNAME)
881-
COCKPIT_HOSTNAME=$(read_var COCKPIT_HOSTNAME)
882-
DOUBLETAKE_HOSTNAME=$(read_var DOUBLETAKE_HOSTNAME)
883-
COMPREFACE_HOSTNAME=$(read_var COMPREFACE_HOSTNAME)
932+
TZ=$(read_var TZ "UTC")
933+
BASE_DOMAIN=$(read_var BASE_DOMAIN "home.local")
934+
GRAFANA_HOSTNAME=$(read_var GRAFANA_HOSTNAME "grafana")
935+
FRIGATE_HOSTNAME=$(read_var FRIGATE_HOSTNAME "frigate")
936+
NODERED_HOSTNAME=$(read_var NODERED_HOSTNAME "nodered")
937+
ZIGBEE2MQTT_HOSTNAME=$(read_var ZIGBEE2MQTT_HOSTNAME "zigbee")
938+
COCKPIT_HOSTNAME=$(read_var COCKPIT_HOSTNAME "cockpit")
939+
DOUBLETAKE_HOSTNAME=$(read_var DOUBLETAKE_HOSTNAME "doubletake")
940+
COMPREFACE_HOSTNAME=$(read_var COMPREFACE_HOSTNAME "compreface")
884941
COMPREFACE_API_KEY=$(read_var COMPREFACE_API_KEY)
885-
GO2RTC_HOSTNAME=$(read_var GO2RTC_HOSTNAME)
942+
GO2RTC_HOSTNAME=$(read_var GO2RTC_HOSTNAME "go2rtc")
886943
fi
887944
fi
888945
}

0 commit comments

Comments
 (0)