TSYS Group COO
bde7845490
Policy rulings (#942): unique passwords, Cloudron-only SSO accounts, no reachableceo credentials, TOTP seeds MUST be captured to the vault. Cloudron admin API wrapper, cookie-jar OIDC login, RFC-6238-tested TOTP helper, per-system SSO/API references, incident log.
24 lines
998 B
Bash
Executable File
24 lines
998 B
Bash
Executable File
#!/bin/bash
|
|
# Authenticated Cloudron admin API call (compliant lever: api-token service
|
|
# account from vault item creds/cloudron — never the founder's accounts).
|
|
# usage: cloudron-api.sh METHOD /api/v1/PATH [JSON-BODY]
|
|
# body -> stdout; HTTP status -> stderr. Secrets never printed.
|
|
set -euo pipefail
|
|
BASE="https://my.knownelement.com"
|
|
METHOD="${1:?usage: cloudron-api.sh METHOD /api/v1/PATH [JSON-BODY]}"
|
|
PATHPART="${2:?usage: cloudron-api.sh METHOD /api/v1/PATH [JSON-BODY]}"
|
|
BODY="${3:-}"
|
|
if [ "$(id -un)" = "TSGCOO" ]; then
|
|
SM() { /data2/TSGCOO/.local/bin/sm "$@" </dev/null; }
|
|
else
|
|
SM() { sudo -u TSGCOO /data2/TSGCOO/.local/bin/sm "$@" </dev/null; }
|
|
fi
|
|
TOKEN=$(SM get creds/cloudron --field password)
|
|
[ -n "$TOKEN" ] || { echo "no cloudron token in vault" >&2; exit 1; }
|
|
ARGS=(-sk -X "$METHOD" "$BASE$PATHPART"
|
|
-H "Authorization: Bearer $TOKEN"
|
|
-H 'Content-Type: application/json'
|
|
-w '\nHTTP %{http_code}\n')
|
|
[ -n "$BODY" ] && ARGS+=(-d "$BODY")
|
|
curl "${ARGS[@]}" >&2
|