Collin Kasbergen
38 lines
1.7 KiB
Bash
38 lines
1.7 KiB
Bash
#!/bin/bash
|
|
set -e
|
|
|
|
# Generate or load secure Icecast password
|
|
if [ -n "$ICECAST_PASSWORD" ] && [ "$ICECAST_PASSWORD" != "hackme" ]; then
|
|
echo "Using user-provided Icecast password."
|
|
echo "$ICECAST_PASSWORD" > /data/.icecast_password
|
|
elif [ ! -f /data/.icecast_password ]; then
|
|
echo "Generating secure Icecast password..."
|
|
# Generate a 24-character random alphanumeric password
|
|
cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 24 | head -n 1 > /data/.icecast_password
|
|
fi
|
|
|
|
export ICECAST_PASSWORD=$(cat /data/.icecast_password)
|
|
|
|
# Inject password into icecast.xml
|
|
sed -i "s/<source-password>.*<\/source-password>/<source-password>${ICECAST_PASSWORD}<\/source-password>/g" /etc/icecast2/icecast.xml
|
|
sed -i "s/<relay-password>.*<\/relay-password>/<relay-password>${ICECAST_PASSWORD}<\/relay-password>/g" /etc/icecast2/icecast.xml
|
|
sed -i "s/<admin-password>.*<\/admin-password>/<admin-password>${ICECAST_PASSWORD}<\/admin-password>/g" /etc/icecast2/icecast.xml
|
|
|
|
# Generate or load symmetric encryption key for DB credentials
|
|
if [ -n "$ENCRYPTION_KEY" ]; then
|
|
echo "Using user-provided Encryption Key."
|
|
echo "$ENCRYPTION_KEY" > /data/.encryption_key
|
|
elif [ ! -f /data/.encryption_key ]; then
|
|
echo "Generating secure Encryption Key..."
|
|
# Generate a Fernet-compatible URL-safe base64 encoded 32-byte key
|
|
python3 -c "import base64; import os; print(base64.urlsafe_b64encode(os.urandom(32)).decode('utf-8'))" > /data/.encryption_key
|
|
fi
|
|
|
|
export ENCRYPTION_KEY=$(cat /data/.encryption_key)
|
|
|
|
# Fix permissions on /data volume so the liquidsoap user can read/write the SQLite database
|
|
chown -R liquidsoap:liquidsoap /data
|
|
|
|
# Execute the main process (supervisord)
|
|
exec /usr/bin/supervisord -c /etc/supervisor/conf.d/supervisord.conf
|