Skip to content

Commit da35308

Browse files
tonytrgtonytrg
authored
refactor secrets (#648)
1 parent 63d5932 commit da35308

14 files changed

+336
-512
lines changed

‎bin/ghe-backup

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -267,6 +267,9 @@ bm_init > /dev/null
267267
ghe-backup-store-version ||
268268
log_warn "Warning: storing backup-utils version remotely failed."
269269

270+
log_info "Backing up GitHub secrets ..."
271+
ghe-backup-secrets || failures="$failures secrets"
272+
270273
log_info "Backing up GitHub settings ..."
271274
ghe-backup-settings || failures="$failures settings"
272275

‎bin/ghe-restore

Lines changed: 1 addition & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -466,26 +466,14 @@ else
466466
fi
467467
CRON_RUNNING=false
468468

469+
ghe-restore-secrets "$GHE_HOSTNAME"
469470

470471
# Restore settings and license if restoring to an unconfigured appliance or when
471472
# specified manually.
472473
if $RESTORE_SETTINGS; then
473474
ghe-restore-settings "$GHE_HOSTNAME"
474475
fi
475476

476-
# Always restore column encryption keys
477-
if [ "$(version $GHE_REMOTE_VERSION)" -ge "$(version 3.7.0)" ]; then
478-
log_info "Always restore encrypted column encryption keys on GHES versions 3.7.0+"
479-
fi
480-
ghe-restore-column-encryption-keys "$GHE_HOSTNAME"
481-
482-
# Always restore secret scanning encryption keys
483-
if [ "$(version $GHE_REMOTE_VERSION)" -ge "$(version 3.8.0)" ]; then
484-
log_info "Always restore secret scanning encryption keys on GHES versions 3.8.0+"
485-
increment-progress-total-count 1
486-
ghe-restore-secret-scanning-encryption-keys "$GHE_HOSTNAME"
487-
fi
488-
489477
# Make sure mysql and elasticsearch are prep'd and running before restoring.
490478
# These services will not have been started on appliances that have not been
491479
# configured yet.
@@ -639,7 +627,6 @@ echo "sudo restart -q memcached 2>/dev/null || true" |
639627
ghe-ssh "$GHE_HOSTNAME" -- /bin/sh
640628
bm_end "$(basename $0) - Restarting memcached"
641629

642-
643630
# Prevent GitHub Connect jobs running before we've had a chance to reset
644631
# the configuration by setting the last run date to now.
645632
if ! $RESTORE_SETTINGS; then

‎share/github-backup-utils/ghe-backup-config

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -659,16 +659,6 @@ prompt_for_confirmation(){
659659
echo
660660
}
661661

662-
# Function to restore a secret setting stored in a file.
663-
# restore-secret <description> <file-name> <setting-name>
664-
restore-secret() {
665-
if [ -f "$GHE_RESTORE_SNAPSHOT_PATH/$2" ]; then
666-
echo "Restoring $1 ..."
667-
echo "ghe-config '$3' '$(cat "$GHE_RESTORE_SNAPSHOT_PATH/$2")'" |
668-
ghe-ssh "$GHE_HOSTNAME" -- /bin/bash
669-
fi
670-
}
671-
672662
#initialize progress tracking by clearing out the temp files used to track
673663
init-progress() {
674664
if [ -d /tmp/backup-utils-progress ]; then

‎share/github-backup-utils/ghe-backup-secrets

Lines changed: 186 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,186 @@
1+
#!/usr/bin/env bash
2+
#/ Usage: ghe-backup-secrets <host>
3+
#/
4+
#/ Note: This script typically isn't called directly. It's invoked by the
5+
#/ ghe-backup command.
6+
set -e
7+
8+
# Bring in the backup configuration
9+
# shellcheck source=share/github-backup-utils/ghe-backup-config
10+
. "$( dirname "${BASH_SOURCE[0]}" )/ghe-backup-config"
11+
12+
# Grab the host
13+
host="$GHE_HOSTNAME"
14+
15+
# Perform a host-check and establish GHE_REMOTE_XXX variables.
16+
ghe_remote_version_required "$host"
17+
18+
19+
# Function to backup a secret setting to a file.
20+
# backup-secret <description> <file-name> <setting-name> [--best-effort]
21+
backup-secret() {
22+
best_effort=false
23+
description=""
24+
file=""
25+
setting=""
26+
count=0
27+
28+
while [ $# -gt 0 ]; do
29+
case "$1" in
30+
--best-effort)
31+
shift 1
32+
best_effort=true
33+
;;
34+
*)
35+
case $count in
36+
0)
37+
description=$1
38+
;;
39+
1)
40+
file=$1
41+
;;
42+
2)
43+
setting=$1
44+
;;
45+
*)
46+
>&2 echo "Too many arguments"
47+
;;
48+
esac
49+
count=$((count+1))
50+
shift 1
51+
esac
52+
done
53+
54+
log_info "* Transferring $description ..." 1>&3
55+
ghe-ssh "$host" -- ghe-config "$setting" > "$file+" || (
56+
if [ "$best_effort" = "false" ]; then
57+
echo "Warning: $description not set" >&2
58+
fi
59+
)
60+
if [ -n "$(cat "$file+")" ]; then
61+
mv "$file+" "$file"
62+
else
63+
unlink "$file+"
64+
fi
65+
}
66+
67+
bm_start "$(basename $0)"
68+
69+
# Create the snapshot directory if needed and change into it.
70+
mkdir -p "$GHE_SNAPSHOT_DIR"
71+
cd "$GHE_SNAPSHOT_DIR"
72+
73+
log_info "* Transferring secrets data ..." 1>&3
74+
75+
backup-secret "management console password" "manage-password" "secrets.manage"
76+
backup-secret "password pepper" "password-pepper" "secrets.github.user-password-secrets"
77+
backup-secret "kredz.credz HMAC key" "kredz-credz-hmac" "secrets.kredz.credz-hmac-secret"
78+
backup-secret "kredz.varz HMAC key" "kredz-varz-hmac" "secrets.kredz.varz-hmac-secret"
79+
80+
# backup encryption keying material and create backup value current encryption for GHES 3.7.0 onwards
81+
# this is for forwards compatibility with GHES 3.8.0 onwards
82+
if [ "$(version $GHE_REMOTE_VERSION)" -ge "$(version 3.7.0)" ]; then
83+
backup-secret "encrypted column encryption keying material" "encrypted-column-encryption-keying-material" "secrets.github.encrypted-column-keying-material"
84+
cat "$GHE_SNAPSHOT_DIR/encrypted-column-encryption-keying-material" | sed 's:.*;::' > "$GHE_SNAPSHOT_DIR/encrypted-column-current-encryption-key"
85+
fi
86+
87+
if [ "$(version $GHE_REMOTE_VERSION)" -ge "$(version 3.8.0)" ]; then
88+
backup-secret "secret scanning encrypted secrets current storage key" "secret-scanning-encrypted-secrets-current-storage-key" "secrets.secret-scanning.encrypted-secrets-current-storage-key"
89+
backup-secret "secret scanning encrypted secrets delimited storage keys" "secret-scanning-encrypted-secrets-delimited-storage-keys" "secrets.secret-scanning.encrypted-secrets-delimited-storage-keys"
90+
backup-secret "secret scanning encrypted secrets current shared transit key" "secret-scanning-encrypted-secrets-current-shared-transit-key" "secrets.secret-scanning.encrypted-secrets-current-shared-transit-key"
91+
backup-secret "secret scanning encrypted secrets delimited shared transit keys" "secret-scanning-encrypted-secrets-delimited-shared-transit-keys" "secrets.secret-scanning.encrypted-secrets-delimited-shared-transit-keys"
92+
fi
93+
94+
if [ "$(version $GHE_REMOTE_VERSION)" -ge "$(version 3.11.0)" ]; then
95+
backup-secret "secret scanning encrypted content keys" "secret-scanning-user-content-delimited-encryption-root-keys" "secrets.secret-scanning.secret-scanning-user-content-delimited-encryption-root-keys"
96+
fi
97+
98+
# Backup argon secrets for multiuser from ghes version 3.8 onwards
99+
if [[ "$(version $GHE_REMOTE_VERSION)" -ge "$(version 3.8.0)" && "$(version $GHE_REMOTE_VERSION)" -lt "$(version 3.8.2)" ]]; then
100+
backup-secret "management console argon2 secret" "manage-argon-secret" "secrets.manage-auth.argon-secret"
101+
fi
102+
103+
# Backup external MySQL password if running external MySQL DB.
104+
if is_service_external 'mysql'; then
105+
backup-secret "external MySQL password" "external-mysql-password" "secrets.external.mysql"
106+
fi
107+
108+
# Backup Actions settings.
109+
if ghe-ssh "$host" -- ghe-config --true app.actions.enabled; then
110+
backup-secret "Actions configuration database login" "actions-config-db-login" "secrets.actions.ConfigurationDatabaseSqlLogin"
111+
backup-secret "Actions configuration database password" "actions-config-db-password" "secrets.actions.ConfigurationDatabaseSqlPassword"
112+
backup-secret "Actions framework access token key secret" "actions-framework-access-token" "secrets.actions.FrameworkAccessTokenKeySecret" --best-effort
113+
backup-secret "Actions Url signing HMAC key primary" "actions-url-signing-hmac-key-primary" "secrets.actions.UrlSigningHmacKeyPrimary"
114+
backup-secret "Actions Url signing HMAC key secondary" "actions-url-signing-hmac-key-secondary" "secrets.actions.UrlSigningHmacKeySecondary"
115+
backup-secret "Actions OAuth S2S signing cert" "actions-oauth-s2s-signing-cert" "secrets.actions.OAuthS2SSigningCert"
116+
backup-secret "Actions OAuth S2S signing key" "actions-oauth-s2s-signing-key" "secrets.actions.OAuthS2SSigningKey"
117+
backup-secret "Actions OAuth S2S signing cert thumbprint" "actions-oauth-s2s-signing-cert-thumbprint" "secrets.actions.OAuthS2SSigningCertThumbprint"
118+
backup-secret "Actions primary encryption cert thumbprint" "actions-primary-encryption-cert-thumbprint" "secrets.actions.PrimaryEncryptionCertificateThumbprint"
119+
backup-secret "Actions AAD cert thumbprint" "actions-aad-cert-thumbprint" "secrets.actions.AADCertThumbprint" --best-effort
120+
backup-secret "Actions delegated auth cert thumbprint" "actions-delegated-auth-cert-thumbprint" "secrets.actions.DelegatedAuthCertThumbprint" --best-effort
121+
backup-secret "Actions runtime service principal cert" "actions-runtime-service-principal-cert" "secrets.actions.RuntimeServicePrincipalCertificate" --best-effort
122+
backup-secret "Actions S2S encryption cert" "actions-s2s-encryption-cert" "secrets.actions.S2SEncryptionCertificate"
123+
backup-secret "Actions secondary encryption cert thumbprint" "actions-secondary-encryption-cert-thumbprint" "secrets.actions.SecondaryEncryptionCertificateThumbprint"
124+
backup-secret "Actions service principal cert" "actions-service-principal-cert" "secrets.actions.ServicePrincipalCertificate" --best-effort
125+
backup-secret "Actions SPS validation cert thumbprint" "actions-sps-validation-cert-thumbprint" "secrets.actions.SpsValidationCertThumbprint"
126+
backup-secret "Actions storage container prefix" "actions-storage-container-prefix" "secrets.actions.storage.container-prefix"
127+
128+
backup-secret "Actions Launch secrets encryption/decryption" "actions-launch-secrets-private-key" "secrets.launch.actions-secrets-private-key"
129+
backup-secret "Actions Launch deployer HMAC key" "actions-launch-deployer-hmac" "secrets.launch.deployer-hmac-secret"
130+
backup-secret "Actions Launch Client id" "actions-launch-client-id" "secrets.launch.client-id"
131+
backup-secret "Actions Launch Client secret" "actions-launch-client-secret" "secrets.launch.client-secret"
132+
backup-secret "Actions Launch receiver webhook secret" "actions-launch-receiver-webhook-secret" "secrets.launch.receiver-webhook-secret"
133+
backup-secret "Actions Launch app private key" "actions-launch-app-private-key" "secrets.launch.app-private-key"
134+
backup-secret "Actions Launch app public key" "actions-launch-app-public-key" "secrets.launch.app-public-key"
135+
backup-secret "Actions Launch app id" "actions-launch-app-id" "secrets.launch.app-id"
136+
backup-secret "Actions Launch app relay id" "actions-launch-app-relay-id" "secrets.launch.app-relay-id"
137+
backup-secret "Actions Launch action runner secret" "actions-launch-action-runner-secret" "secrets.launch.action-runner-secret"
138+
backup-secret "Actions Launch service cert" "actions-launch-azp-app-cert" "secrets.launch.azp-app-cert"
139+
backup-secret "Actions Launch service private key" "actions-launch-app-app-private-key" "secrets.launch.azp-app-private-key"
140+
fi
141+
142+
if ghe-ssh "$host" -- ghe-config --true app.packages.enabled; then
143+
backup-secret "Packages aws access key" "packages-aws-access-key" "secrets.packages.aws-access-key"
144+
backup-secret "Packages aws secret key" "packages-aws-secret-key" "secrets.packages.aws-secret-key"
145+
backup-secret "Packages s3 bucket" "packages-s3-bucket" "secrets.packages.s3-bucket"
146+
backup-secret "Packages storage service url" "packages-service-url" "secrets.packages.service-url"
147+
backup-secret "Packages blob storage type" "packages-blob-storage-type" "secrets.packages.blob-storage-type"
148+
backup-secret "Packages azure connection string" "packages-azure-connection-string" "secrets.packages.azure-connection-string"
149+
backup-secret "Packages azure container name" "packages-azure-container-name" "secrets.packages.azure-container-name"
150+
fi
151+
152+
# Backup Chat Integration settings
153+
if ghe-ssh "$host" -- ghe-config --true app.chatops.enabled; then
154+
backup-secret "Chat Integration MSTeams app id" "chatops-msteams-app-id" "secrets.chatops.msteams.app-id"
155+
backup-secret "Chat Integration MSTeams app password" "chatops-msteams-app-password" "secrets.chatops.msteams.app-password"
156+
backup-secret "Chat Integration MSTeams public endpoint" "chatops-msteams-app-public-endpoint" "secrets.chatops.msteams.public-endpoint"
157+
backup-secret "Chat Integration MSTeams bot handle" "chatops-msteams-bot-handle" "secrets.chatops.msteams.bot-handle"
158+
backup-secret "Chat Integration MSTeams bot name" "chatops-msteams-bot-name" "secrets.chatops.msteams.bot-name"
159+
backup-secret "Chat Integration Slack app id" "chatops-slack-app-id" "secrets.chatops.slack.app-id"
160+
backup-secret "Chat Integration Slack client id" "chatops-slack-client-id" "secrets.chatops.slack.client-id"
161+
backup-secret "Chat Integration Slack client secret" "chatops-slack-client-secret" "secrets.chatops.slack.client-secret"
162+
backup-secret "Chat Integration Slack verification token" "chatops-slack-verification-token" "secrets.chatops.slack.verification-token"
163+
backup-secret "Chat Integration Slack config token" "chatops-slack-config-token" "secrets.chatops.slack.config-token"
164+
backup-secret "Chat Integration Slack public endpoint" "chatops-slack-public-endpoint" "secrets.chatops.slack.public-endpoint"
165+
backup-secret "Chat Integration Slack signing secret" "chatops-slack-signing-secret" "secrets.chatops.slack.signing-secret"
166+
backup-secret "Chat Integration Slack app level token" "chatops-slack-app-level-token" "secrets.chatops.slack.app-level-token"
167+
backup-secret "Chat Integration Slack slack command" "chatops-slack-slash-command" "secrets.chatops.slack.slash-command"
168+
backup-secret "Chat Integration Slack app name" "chatops-slack.app-name" "secrets.chatops.slack.app-name"
169+
backup-secret "Chat Integration Slack socket mode" "chatops-slack.socket-mode" "secrets.chatops.slack.socket-mode"
170+
backup-secret "Chat Integration public endpoint" "chatops-public-endpoint" "secrets.chatops.public-endpoint"
171+
backup-secret "Chat Integration app type" "chatops-app-type" "secrets.chatops.app-type"
172+
backup-secret "Chat Integration app id teams" "chatops-app-id-teams" "secrets.chatops.app-id-teams"
173+
backup-secret "Chat Integration webhook secret teams" "chatops-webhook-secret-teams" "secrets.chatops.webhook-secret-teams"
174+
backup-secret "Chat Integration client secret teams" "chatops-client-secret-teams" "secrets.chatops.client-secret-teams"
175+
backup-secret "Chat Integration clien id teams" "chatops-client-id-teams" "secrets.chatops.client-id-teams"
176+
backup-secret "Chat Integration storage secret" "chatops-storage-secret" "secrets.chatops.storage-secret"
177+
backup-secret "Chat Integration session secret" "chatops-session-secret" "secrets.chatops.session-secret"
178+
backup-secret "Chat Integration app id slack" "chatops-app-id-slack" "secrets.chatops.app-id-slack"
179+
backup-secret "Chat Integration webhook secret slack" "chatops-webhook-secret-slack" "secrets.chatops.webhook-secret-slack"
180+
backup-secret "Chat Integration client secret slack" "chatops-client-secret-slack" "secrets.chatops.client-secret-slack"
181+
backup-secret "Chat Integration client id slack" "chatops-client-id-slack" "secrets.chatops.client-id-slack"
182+
fi
183+
184+
bm_end "$(basename $0)"
185+
186+
exit 0

0 commit comments

Comments
 (0)