52 lines
1.5 KiB
Bash
52 lines
1.5 KiB
Bash
#!/bin/dash
|
|
# Applies the full hectic SQL bundle to a PostgreSQL database, in order:
|
|
# 1. version (hard-fails on version mismatch)
|
|
# 2. secret (hectic.secret table + load_secrets_from_env + get_secret)
|
|
# 3. migration (hectic.migration table + domains + sha256_lower trigger)
|
|
# 4. inheritance (created_at/updated_at/immutable enforcement triggers)
|
|
#
|
|
# Idempotent: each SQL file uses IF NOT EXISTS / CREATE OR REPLACE.
|
|
#
|
|
# Usage:
|
|
# apply_hectic_bundle <PGURL> [<DOTENV_CONTENT>]
|
|
#
|
|
# If DOTENV_CONTENT is non-empty, it is base64-encoded and then loaded into
|
|
# hectic.secret via hectic.load_secrets_from_env() after the bundle is applied.
|
|
# SQL file paths are substituted by Nix evaluation time.
|
|
|
|
apply_hectic_bundle() {
|
|
pgurl="${1:-}"
|
|
env_content="${2:-}"
|
|
|
|
if [ -z "$pgurl" ]; then
|
|
printf '%s\n' 'apply-hectic-bundle: PGURL is required (arg 1)' >&2
|
|
return 3
|
|
fi
|
|
|
|
set -- \
|
|
"@HECTIC_VERSION_SQL@" \
|
|
"@HECTIC_SECRET_SQL@" \
|
|
"@HECTIC_MIGRATION_SQL@" \
|
|
"@HECTIC_INHERITANCE_SQL@"
|
|
|
|
for sql_path do
|
|
if [ ! -r "$sql_path" ]; then
|
|
printf '%s\n' "apply-hectic-bundle: SQL file not readable: $sql_path" >&2
|
|
return 1
|
|
fi
|
|
done
|
|
|
|
for sql_path do
|
|
psql "$pgurl" -v ON_ERROR_STOP=1 -f "$sql_path" || return 1
|
|
done
|
|
|
|
if [ -n "$env_content" ]; then
|
|
env_content_b64="$(printf '%s' "$env_content" | base64 | tr -d '\n')" || return 1
|
|
psql "$pgurl" -v ON_ERROR_STOP=1 <<SQL || return 1
|
|
SELECT hectic.load_secrets_from_env(convert_from(decode('$env_content_b64', 'base64'), 'UTF8'));
|
|
SQL
|
|
fi
|
|
|
|
return 0
|
|
}
|