19 lines
543 B
Bash
19 lines
543 B
Bash
|
#!/bin/bash
|
|||
|
|
# 配置加密：.env → .env.enc（参考 PineSoundServer envcopy.sh）
|
|||
|
|
# 用途：生产机不落明文配置，仅保留加密包；部署时解密注入。
|
|||
|
|
set -euo pipefail
|
|||
|
|
|
|||
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|||
|
|
cd "$ROOT"
|
|||
|
|
|
|||
|
|
ENC_KEY="${ENC_KEY:-}"
|
|||
|
|
if [ -z "$ENC_KEY" ]; then
|
|||
|
|
echo "错误：请设置 ENC_KEY（openssl rand -hex 32）" >&2
|
|||
|
|
exit 1
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
SRC="${1:-.env}"
|
|||
|
|
DST="${SRC}.enc"
|
|||
|
|
openssl enc -aes-256-cbc -pbkdf2 -salt -in "$SRC" -out "$DST" -pass pass:"$ENC_KEY"
|
|||
|
|
echo "已加密：$SRC -> $DST"
|