From 3a8fb09bcfe22394e2a14380114286f37b343d06 Mon Sep 17 00:00:00 2001
From: Timothy Kim <timothykim@fastmail.fm>
Date: Thu, 19 Mar 2026 12:11:46 -0400
Subject: [PATCH] add .env generation from bws, handle build services in deploy

- configure.sh generates .env files from .env.keys + bws
- deploy.sh detects build: services and runs docker compose build
- new-service.sh prints .env.keys instructions
- clean up .gitignore
---
 .gitignore           |  7 ++++---
 scripts/configure.sh | 34 +++++++++++++++++++++++++++++++++-
 scripts/deploy.sh    | 10 +++++++---
 tools/new-service.sh |  6 ++++++
 4 files changed, 50 insertions(+), 7 deletions(-)

diff --git a/.gitignore b/.gitignore
index db6b62e..c9b5a03 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,7 @@
-containerd/
-vultr/
+*.swp
+docker/**/.env
 docker/nginx/data/
 docker/nginx/certs/
 docker/nginx/certbot/
-*.swp
+docker/garage/data/
+docker/garage/meta/
diff --git a/scripts/configure.sh b/scripts/configure.sh
index ae1be80..e8fd5e3 100755
--- a/scripts/configure.sh
+++ b/scripts/configure.sh
@@ -2,7 +2,7 @@
 set -euo pipefail
 
 # Idempotent server configuration. Safe to run from CI or manually.
-# No secrets required — only configures firewall, certbot, and starts services.
+# Uses bws to generate .env files for services that need secrets.
 
 REPO_DIR="/opt/hantim"
 
@@ -56,6 +56,38 @@ for conf in "$REPO_DIR"/docker/nginx/conf.d/*.conf; do
     certbot certonly --standalone --non-interactive --agree-tos --register-unsafely-without-email --cert-name "$cert_name" $domain_args
 done
 
+echo "==> Generating .env files from Bitwarden Secrets Manager..."
+BWS_TOKEN_FILE="/etc/bws-token"
+if [ -f "$BWS_TOKEN_FILE" ]; then
+    export BWS_ACCESS_TOKEN
+    BWS_ACCESS_TOKEN=$(cat "$BWS_TOKEN_FILE")
+    ALL_SECRETS=$(bws secret list)
+    for keys_file in "$REPO_DIR"/docker/*/.env.keys; do
+        [ -f "$keys_file" ] || continue
+        app_dir=$(dirname "$keys_file")
+        app_name=$(basename "$app_dir")
+        env_content=""
+        while IFS= read -r line || [ -n "$line" ]; do
+            [ -z "$line" ] && continue
+            var_name="${line%%=*}"
+            secret_key="${line#*=}"
+            value=$(echo "$ALL_SECRETS" | jq -r --arg key "$secret_key" '.[] | select(.key == $key) | .value')
+            if [ -z "$value" ]; then
+                echo "  WARNING: Secret '$secret_key' not found in bws, skipping."
+                continue
+            fi
+            env_content="${env_content}${var_name}=${value}"$'\n'
+        done < "$keys_file"
+        if [ -n "$env_content" ]; then
+            echo "  Writing .env for $app_name"
+            printf "%s" "$env_content" > "$app_dir/.env"
+            chmod 600 "$app_dir/.env"
+        fi
+    done
+else
+    echo "  No bws token found, skipping .env generation."
+fi
+
 echo "==> Starting services..."
 # Start nginx first (creates the shared network)
 cd "$REPO_DIR/docker/nginx"
diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index 016d097..27b4c86 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -48,9 +48,13 @@ APP="${CMD#deploy-}"
 cd /opt/hantim
 git pull
 cd "docker/$APP"
-if ! docker compose pull; then
-    echo "Image not yet available for $APP — skipping. It will deploy when the app repo is first pushed."
-    exit 0
+if grep -q '^\s*build:' compose.yml 2>/dev/null; then
+    docker compose build
+else
+    if ! docker compose pull; then
+        echo "Image not yet available for $APP — skipping. It will deploy when the app repo is first pushed."
+        exit 0
+    fi
 fi
 
 if [ "$APP" = "nginx" ]; then
diff --git a/tools/new-service.sh b/tools/new-service.sh
index 3771aac..1eb7120 100755
--- a/tools/new-service.sh
+++ b/tools/new-service.sh
@@ -64,3 +64,9 @@ OUTER
 sed -i "s/APP_PLACEHOLDER/$APP/g" "$REPO_ROOT/.gitea/workflows/deploy-$APP.yml"
 
 echo "Done. Edit docker/$APP/compose.yml, then commit and push."
+echo ""
+echo "If this service needs secrets:"
+echo "  1. Add secrets to Bitwarden Secrets Manager"
+echo "  2. Map them in docker/$APP/.env.keys (format: ENV_VAR=bws-secret-name)"
+echo "  3. Add env_file: .env to compose.yml"
+echo "  configure.sh will generate the .env file on the server automatically."