crank/scripts/load-openbao-env.sh

#!/usr/bin/env bash
set -euo pipefail

: "${BAO_ADDR:?BAO_ADDR is required}"
: "${BAO_TOKEN:?BAO_TOKEN is required}"
: "${BAO_SECRET_PATH:?BAO_SECRET_PATH is required}"

output="${OPENBAO_ENV_FILE:-.openbao-env}"
payload="$(mktemp)"
trap 'rm -f "$payload"' EXIT

curl --fail --silent --show-error \
  --header "X-Vault-Token: ${BAO_TOKEN}" \
  "${BAO_ADDR%/}/v1/${BAO_SECRET_PATH#/}" \
  > "$payload"

python3 - "$payload" "$output" <<'PY'
import json
import re
import shlex
import sys
from pathlib import Path

payload_path = Path(sys.argv[1])
output_path = Path(sys.argv[2])

payload = json.loads(payload_path.read_text(encoding="utf-8"))
data = payload.get("data", {})

if isinstance(data, dict) and isinstance(data.get("data"), dict):
    data = data["data"]

if not isinstance(data, dict):
    raise SystemExit("OpenBao response does not contain an object secret payload")

name_re = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
lines = [
    "# Generated by scripts/load-openbao-env.sh",
    "# Do not commit this file.",
]

for key in sorted(data):
    if not name_re.match(key):
        raise SystemExit(f"Unsupported environment variable name from OpenBao: {key}")
    value = data[key]
    if value is None:
        continue
    if isinstance(value, bool):
        value = "true" if value else "false"
    elif not isinstance(value, str):
        value = str(value)
    lines.append(f"export {key}={shlex.quote(value)}")

output_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
output_path.chmod(0o600)
print(f"Loaded {len(lines) - 2} OpenBao values into {output_path}", file=sys.stderr)
PY