How to use brew programs in shell script

[damms005]

I installed mkcert via Homebrew.

I can run mkcert --version from the command line succesfully.

However, when I create the following script:

#!/bin/bash

# set -x
echo $(git --version)
echo $(mkcert --version)

The output is:

git version 2.25.1
./my-script.sh: line 5: mkcert: command not found

Note that I put echo $(git --version) in the script just to test that my script is working.

Any ideas why mkcert installed via brew not working in shell script or am I doing something wrong?

[SMillerDev]

Try using the full path.

[gromgit]

The most common reason: Homebrew's bin directory is not in the script's PATH environment variable, which is inherited from whatever executed that script.

You didn't say how you tried to run your script, but one gotcha that catches every Unix newbie involves cron jobs. Every cron daemon I've seen is started at boot time, so it generally inherits a PATH that doesn't include Homebrew. Most cron daemons also sanitize the PATH they pass to the scripts they run, usually reducing it to just /usr/bin:/bin.

If you know that a script uses Homebrew-installed binaries, and you don't want to fully-qualify every invocation, simply add:

eval "$(/path/to/brew shellenv)"

to the start of your script. (That's the same command that's printed at the end of the Homebrew installer script.)

[damms005]

@gromgit @SMillerDev My bad, apologies for my non-extensive details.

My aim is to have an automated script that bootstraps new Laravel/PHP projects for me, with SSL fully configured. I am trying to achieve this using mkcert with the script below. Kindly help me fine-tune the script to allow me to achieve this aim, or give me expert opinion perhaps there are better ways of achieving the same:

#!/bin/bash

#Ensure to have installed mkcert: https://github.com/FiloSottile/mkcert

# set -x

# Run like:
# sudo create-secure-site.sh site-url
sample_run="sudo create-secure-site.sh mysite.local"
site_fqdn=$1

#check that site name is provided
if [[ -z "$site_fqdn" ]]
then
  	echo "You must include a site name. Usage: $sample_run";
		exit
fi

#check that site name is fqdn
if ! grep -q ".\+\..\+" <<< $site_fqdn
then
  	echo "Site name must be FQDN. Usage: $sample_run";
		exit
fi

#check that we have mkcert
mkcert_path=mkcert=$(which mkcert)
if [[ -z "$mkcert_path" ]]
then
  echo 'mkcert not found. Please install following guide: https://github.com/FiloSottile/mkcert'
  exit
fi

#check for root access
if [[ "$USER" != "root" ]]
then
  echo 'Script must not be run as root (or with sudo)'
  exit
fi

site_hostname="$(echo $site_fqdn | sed  -E "s/\..*//")"
apache_public_dir_for_site=~/Documents/sites/${site_hostname}/public
non_priviledged_owner=$(whomai)

######################################################################
############################# STAGE 1 ################################
######################################################################
#Make SSL certificate
echo -e "\nGenerating SSL certificates for ${site_fqdn}..."
#Certificate should be generated as non-root, so we sure browsers can read it at request time
sudo -u $non_priviledged_owner mkcert $site_fqdn
#Copy the generated certs
find ./ -iname "$site_fqdn*" -exec mv -v '{}' /etc/ssl/certs/ \;

######################################################################
############################# STAGE 2 ################################
######################################################################

site_normal_config_path="/etc/apache2/sites-available/${site_fqdn}.conf"
if [[ ! -e "$site_normal_config_path" ]]
then
	echo "
	<VirtualHost *:80>
					ServerName $site_fqdn
					ServerAlias www.$site_fqdn
					ServerAdmin webmaster@localhost
			DocumentRoot ${apache_public_dir_for_site}
					<Directory ${apache_public_dir_for_site}>
									Options Indexes FollowSymLinks MultiViews
									AllowOverride All
									Order allow,deny
									allow from all
					</Directory>
					ErrorLog \${APACHE_LOG_DIR}/error.log
					# Possible values include: debug, info, notice, warn, error, crit,
					# alert, emerg.
					LogLevel warn
					CustomLog \${APACHE_LOG_DIR}/access.log combined
	</VirtualHost>"  > "$site_normal_config_path"
	echo "Added $site_normal_config_path"
else
	echo "$site_fqdn already has $site_normal_config_path"
fi

site_ssl_config_path="/etc/apache2/sites-available/${site_fqdn}-ssl.conf"
if [[ ! -e "$site_ssl_config_path" ]]
then
	echo "
	<VirtualHost *:443>
			ServerName $site_fqdn
			DocumentRoot ${apache_public_dir_for_site}
			<Directory ${apache_public_dir_for_site}>
				Options Indexes FollowSymLinks
				AllowOverride All
				Require all granted
				Order allow,deny
				allow from all
			</Directory>

			ErrorLog \${APACHE_LOG_DIR}/error.log
			CustomLog \${APACHE_LOG_DIR}/access.log combined

			SSLEngine on
			SSLCertificateKeyFile	/etc/ssl/certs/${site_fqdn}-key.pem
			SSLCertificateFile	/etc/ssl/certs/${site_fqdn}.pem

			<FilesMatch \"\.(cgi|shtml|phtml|php)$\">
				SSLOptions +StdEnvVars
			</FilesMatch>
			<Directory /usr/lib/cgi-bin>
				SSLOptions +StdEnvVars
			</Directory>
	</VirtualHost>" > "$site_ssl_config_path"
	echo "Added $site_ssl_config_path"
else
	echo "$site_fqdn already has $site_ssl_config_path"
fi

sudo a2ensite "${site_fqdn}.conf"
sudo a2ensite "${site_fqdn}-ssl.conf"

######################################################################
############################# STAGE 3 ################################
######################################################################
#Add to /etc/hosts
host_file_path=/etc/hosts
if grep -q "$site_fqdn" "$host_file_path"
then
	echo "$site_fqdn is already listed in ${host_file_path}..."
else
	echo "$site_fqdn is not listed in ${host_file_path}. Now adding it."
	echo -e "127.0.0.1\t$site_fqdn" >> $host_file_path
fi

######################################################################
############################# STAGE 4 ################################
######################################################################
if [[ -d "$apache_public_dir_for_site" ]]
then
	echo The document directory \($apache_public_dir_for_site\) already exists. No need to create it again.
else
	sudo -u $non_priviledged_owner mkdir -vp "$apache_public_dir_for_site"
	chmod -vR 0777 "$apache_public_dir_for_site"
fi


######################################################################
############################# STAGE 5 ################################
######################################################################
if [[ -d "${apache_public_dir_for_site}/../.git" ]]
then
	echo No need to initialize git repo
else
	sudo -u $non_priviledged_owner git --git-dir="$apache_public_dir_for_site" init
	sudo -u $non_priviledged_owner git --git-dir="$apache_public_dir_for_site" add .
	sudo -u $non_priviledged_owner git commit -m 'First commit'
fi

echo "Restating apache..."
service apache2 restart

echo "Done. $site_fqdn is ready, both on HTTP and HTTPS!"

[gromgit]

Doing a full code review is beyond the scope of this forum, so I'll remind you of something I've already written:

If you know that a script uses Homebrew-installed binaries, and you don't want to fully-qualify every invocation, simply add:

eval "$(/path/to/brew shellenv)"

to the start of your script. (That's the same command that's printed at the end of the Homebrew installer script.)

and point out a few glaring issues.

ISSUE 0

You haven't run your script through shellcheck. Always run your shell scripts through shellcheck.

brew install shellcheck, then shellcheck create_secure_site.sh

ISSUE 1

mkcert_path=mkcert=$(which mkcert)
if [[ -z "$mkcert_path" ]]

This assignment statement actually does:

mkcert_path="mkcert=$(which mkcert)"

so mkcert_path is never empty, and your if statement is useless.

ISSUE 2

You're running your script as root, which then does a ton of stuff as yourself. Since root can do just about anything, logic errors in your script can do Very Bad Things. It's far FAR better to invert that: run your script as yourself (or your desired web user), which then invokes sudo to do only the parts that require root.

If you're running your script as root to write files as root, note that:

# echo "blah blah" > /path/to/my.conf

and:

$ echo "blah blah" | sudo tee /path/to/my.conf > /dev/null

are functionally equivalent.

[damms005]

Doing a full code review is beyond the scope of this forum, so I'll remind you of something I've already written:

I will effect the suggestions you made, However, which forum/platform can I use to provide the update to the script as you advised so that you can provide your expert guidance on making this script behave as intended and securely so, please?

[SMillerDev]

However, which forum/platform can I use to provide the update to the script as you advised so that you can provide your expert guidance on making this script behave as intended and securely so, please?

If you want a full, secure, expert review of your code. Hire someone.
This forum exists for problems people have with Homebrew, not to help with all scripting.

[carlocab]

By the way, the reason why your shell script can't find things you brew installed is because you're running it under sudo. This sanitises the environment it runs in, so /opt/homebrew/bin won't be in PATH in your script.

[damms005]

Thanks so much @carlocab . This is most helpful 🙏 . Taking this and Miller's insights, I'll just ditch the whole sudo thing so that I'll live an easier life :p)