51 lines
1.8 KiB
Python
51 lines
1.8 KiB
Python
#!/usr/bin/env python3
|
|
"""One-time provisioning of the Fleet Ops demo client identity. Idempotent.
|
|
|
|
Run this once before minting any demo tokens with mint_demo_token.py.
|
|
Connects to the real Hub database using the same HUB_DATABASE_* environment
|
|
variables and secret file the dataplane router itself uses.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import sys
|
|
|
|
|
|
def main() -> int:
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
|
parser.add_argument(
|
|
"--database-url",
|
|
default=None,
|
|
help="Full SQLAlchemy database URL, e.g. postgresql+psycopg://user:pass@host:5432/db. "
|
|
"Overrides HUB_DATABASE_* environment variables and the default /run/secrets password "
|
|
"file -- use this when running outside a container that has that secret mounted.",
|
|
)
|
|
args = parser.parse_args()
|
|
|
|
from services.control_api.persistence.db import (
|
|
create_engine_from_url,
|
|
session_factory,
|
|
)
|
|
from services.control_api.persistence.demo_client import provision_demo_client
|
|
from services.runtime.common import hub_database_url
|
|
|
|
engine = create_engine_from_url(args.database_url or hub_database_url())
|
|
try:
|
|
sessions = session_factory(engine)
|
|
with sessions() as session, session.begin():
|
|
# Project/environment are deliberately NOT exposed as CLI flags:
|
|
# the demo identity's scope is fixed at mobilityops/prod by
|
|
# provision_demo_client's own defaults and must never be widened
|
|
# from the command line.
|
|
result = provision_demo_client(session)
|
|
finally:
|
|
engine.dispose()
|
|
print(f"demo client id: {result.client_id}")
|
|
print(f"binding id: {result.binding_id}")
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main())
|