Add secure nginx installer with API key auto-discovery

install-nginx.sh

@@ -0,0 +1,341 @@
+#!/bin/bash
+set -euo pipefail
+
+# ===========================================================================
+# install-nginx.sh
+# Builds nginx from source, wires up a systemd unit, and configures a
+# reverse proxy that injects an upstream API key server-side.
+#
+# The API key is resolved automatically (Vault / AWS Secrets Manager /
+# local files / systemd units), stored ONLY in a root-only runtime env
+# file, and is never written into nginx.conf.
+# ===========================================================================
+
+# ---------------------------------------------------------------------------
+# Variables
+# ---------------------------------------------------------------------------
+NGINX_VERSION=1.25.3
+INSTALL_PATH=/usr/local/nginx
+SERVICE_FILE=/etc/systemd/system/nginx.service
+TEMPLATE_FILE=/tmp/nginx.conf.template
+
+# Runtime env file consumed by systemd -> nginx master process.
+# This is where the ONLY copy of the key lives at rest (chmod 600, root).
+RUNTIME_ENV=/etc/nginx-upstream.env
+SECRET_FILE=/etc/nginx-secrets.env          # legacy/cache; read for back-compat
+
+DEFAULT_API_KEY="__REPLACE_ME__"
+
+# --- HashiCorp Vault -------------------------------------------------------
+VAULT_ADDR="${VAULT_ADDR:-}"
+VAULT_SECRET_PATH="${VAULT_SECRET_PATH:-}"
+VAULT_SECRET_FIELD="${VAULT_SECRET_FIELD:-api_key}"
+VAULT_TOKEN_FILE="${VAULT_TOKEN_FILE:-/etc/vault-token}"
+# AppRole (used only if no token above is available)
+VAULT_ROLE_ID="${VAULT_ROLE_ID:-}"
+VAULT_SECRET_ID_FILE="${VAULT_SECRET_ID_FILE:-/etc/vault-approle-secret-id}"
+
+# --- AWS Secrets Manager ---------------------------------------------------
+AWS_SECRET_ID="${AWS_SECRET_ID:-}"
+AWS_SECRET_FIELD="${AWS_SECRET_FIELD:-api_key}"
+AWS_REGION="${AWS_REGION:-${AWS_DEFAULT_REGION:-us-east-1}}"
+
+# --- Heuristic local sources ----------------------------------------------
+LOCAL_KEY_SOURCES=(
+  "/etc/myapp/api.key"
+  "/etc/myapp/secrets.env"
+  "/opt/app/.env"
+  "/etc/environment"
+)
+BACKEND_UNITS=( "myapp.service" "model-api.service" )
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+log()  { printf '[setup] %s\n' "$*"; }
+warn() { printf '[setup][warn] %s\n' "$*" >&2; }
+
+ensure_secret_tools() {
+  if [[ -n "$VAULT_SECRET_PATH" || -n "$AWS_SECRET_ID" ]]; then
+    apt-get update -qq || true
+    apt-get install -y jq >/dev/null 2>&1 || warn "jq unavailable; using sed fallback"
+  fi
+  if [[ -n "$AWS_SECRET_ID" ]] && ! command -v aws >/dev/null 2>&1; then
+    apt-get install -y awscli >/dev/null 2>&1 || warn "awscli not installable"
+  fi
+}
+
+# Extract the first API key-ish value from a KEY=VALUE style file.
+key_from_envfile() {
+  local file="$1" name val
+  [[ -r "$file" ]] || return 1
+  while IFS='=' read -r name val; do
+    name="${name//[[:space:]]/}"; name="${name#export}"
+    case "$name" in
+      UPSTREAM_API_KEY|API_KEY|OPENAI_API_KEY|MODEL_API_KEY|LLM_API_KEY)
+        val="${val%%#*}"; val="${val//\"/}"; val="${val//\'/}"
+        val="${val//[[:space:]]/}"
+        [[ -n "$val" ]] && { printf '%s' "$val"; return 0; }
+        ;;
+    esac
+  done < "$file"
+  return 1
+}
+
+# Whole file (trimmed) is the key.
+key_from_keyfile() {
+  local file="$1"
+  [[ -r "$file" ]] || return 1
+  tr -d '[:space:]' < "$file" | head -c 512
+}
+
+# Mine a systemd unit for EnvironmentFile= / Environment= keys.
+key_from_systemd_unit() {
+  local unit="$1" unitfile ef found inline
+  for dir in /etc/systemd/system /lib/systemd/system /usr/lib/systemd/system; do
+    unitfile="$dir/$unit"
+    [[ -f "$unitfile" ]] || continue
+    while read -r ef; do
+      ef="${ef#-}"
+      found="$(key_from_envfile "$ef" 2>/dev/null || true)"
+      [[ -n "$found" ]] && { printf '%s' "$found"; return 0; }
+    done < <(sed -nE 's/^[[:space:]]*EnvironmentFile=//p' "$unitfile")
+    inline="$(sed -nE \
+      's/.*(UPSTREAM_API_KEY|API_KEY|OPENAI_API_KEY|MODEL_API_KEY|LLM_API_KEY)=([^[:space:]]+).*/\2/p' \
+      "$unitfile" | head -n1)"
+    [[ -n "$inline" ]] && { printf '%s' "$inline"; return 0; }
+  done
+  return 1
+}
+
+# --- Vault: token file, then AppRole --------------------------------------
+vault_login() {
+  # Prefer an existing VAULT_TOKEN; else token file; else AppRole.
+  if [[ -z "${VAULT_TOKEN:-}" && -r "$VAULT_TOKEN_FILE" ]]; then
+    VAULT_TOKEN="$(<"$VAULT_TOKEN_FILE")"
+  fi
+  if [[ -n "${VAULT_TOKEN:-}" ]]; then
+    printf '%s' "$VAULT_TOKEN"; return 0
+  fi
+
+  # AppRole login: role_id + secret_id (from file), token captured in-var only.
+  [[ -n "$VAULT_ROLE_ID" && -r "$VAULT_SECRET_ID_FILE" ]] || return 1
+  local secret_id resp tok
+  secret_id="$(<"$VAULT_SECRET_ID_FILE")"
+  resp="$(vault write -format=json auth/approle/login \
+            role_id="$VAULT_ROLE_ID" secret_id="$secret_id" 2>/dev/null)" || return 1
+  if command -v jq >/dev/null 2>&1; then
+    tok="$(printf '%s' "$resp" | jq -r '.auth.client_token // empty')"
+  else
+    tok="$(printf '%s' "$resp" | sed -nE 's/.*"client_token"[: ]*"([^"]+)".*/\1/p' | head -n1)"
+  fi
+  [[ -n "$tok" ]] || return 1
+  printf '%s' "$tok"
+}
+
+key_from_vault() {
+  command -v vault >/dev/null 2>&1 || return 1
+  [[ -n "$VAULT_ADDR" && -n "$VAULT_SECRET_PATH" ]] || return 1
+  export VAULT_ADDR
+  VAULT_TOKEN="$(vault_login)" || return 1
+  export VAULT_TOKEN
+  vault kv get -field="$VAULT_SECRET_FIELD" "$VAULT_SECRET_PATH" 2>/dev/null
+}
+
+# --- AWS Secrets Manager ---------------------------------------------------
+key_from_aws() {
+  command -v aws >/dev/null 2>&1 || return 1
+  [[ -n "$AWS_SECRET_ID" ]] || return 1
+  export AWS_REGION
+  local secret
+  secret="$(aws secretsmanager get-secret-value \
+              --secret-id "$AWS_SECRET_ID" \
+              --query SecretString --output text 2>/dev/null)" || return 1
+  [[ -n "$secret" ]] || return 1
+  if command -v jq >/dev/null 2>&1; then
+    printf '%s' "$secret" | jq -r --arg k "$AWS_SECRET_FIELD" '.[$k] // empty'
+  else
+    printf '%s' "$secret" \
+      | sed -nE "s/.*\"${AWS_SECRET_FIELD}\"[[:space:]]*:[[:space:]]*\"([^\"]+)\".*/\1/p" | head -n1
+  fi
+}
+
+# ===========================================================================
+# 0a. Resolve the key (env / cache / Vault / AWS / local / placeholder)
+# ===========================================================================
+[[ -f "$SECRET_FILE" ]] && { source "$SECRET_FILE"; }
+[[ -f "$RUNTIME_ENV"  ]] && { source "$RUNTIME_ENV"; }
+
+: "${UPSTREAM_URL:=http://127.0.0.1:5000/}"
+: "${LISTEN_PORT:=80}"
+
+if [[ -z "${UPSTREAM_API_KEY:-}" ]]; then
+  ensure_secret_tools
+  log "No UPSTREAM_API_KEY set; resolving from configured sources..."
+  candidate=""
+
+  if [[ -n "$VAULT_SECRET_PATH" ]]; then
+    candidate="$(key_from_vault || true)"
+    [[ -n "$candidate" ]] && log "Fetched key from Vault ($VAULT_SECRET_PATH)"
+  fi
+  if [[ -z "$candidate" && -n "$AWS_SECRET_ID" ]]; then
+    candidate="$(key_from_aws || true)"
+    [[ -n "$candidate" ]] && log "Fetched key from AWS Secrets Manager ($AWS_SECRET_ID)"
+  fi
+  if [[ -z "$candidate" ]]; then
+    for src in "${LOCAL_KEY_SOURCES[@]}"; do
+      if [[ "$src" == *.key ]]; then
+        candidate="$(key_from_keyfile "$src" 2>/dev/null || true)"
+      else
+        candidate="$(key_from_envfile "$src" 2>/dev/null || true)"
+      fi
+      [[ -n "$candidate" ]] && { log "Found key in $src"; break; }
+    done
+  fi
+  if [[ -z "$candidate" ]]; then
+    for unit in "${BACKEND_UNITS[@]}"; do
+      candidate="$(key_from_systemd_unit "$unit" 2>/dev/null || true)"
+      [[ -n "$candidate" ]] && { log "Found key via systemd unit: $unit"; break; }
+    done
+  fi
+  [[ -n "$candidate" ]] && UPSTREAM_API_KEY="$candidate"
+fi
+
+if [[ -z "${UPSTREAM_API_KEY:-}" ]]; then
+  UPSTREAM_API_KEY="$DEFAULT_API_KEY"
+  warn "No API key resolved; using placeholder ($DEFAULT_API_KEY)."
+fi
+export UPSTREAM_API_KEY UPSTREAM_URL LISTEN_PORT
+
+# ===========================================================================
+# 0b. Write the RUNTIME env file (systemd -> nginx). Key stored ONLY here.
+# ===========================================================================
+log "Writing runtime env to $RUNTIME_ENV (chmod 600)"
+( umask 077 && cat > "$RUNTIME_ENV" <<EOF
+UPSTREAM_API_KEY=$UPSTREAM_API_KEY
+EOF
+)
+chmod 600 "$RUNTIME_ENV"
+
+# ---------------------------------------------------------------------------
+# 1. Build dependencies (gettext-base => envsubst)
+# ---------------------------------------------------------------------------
+apt-get update
+apt-get install -y \
+  build-essential libpcre3 libpcre3-dev zlib1g zlib1g-dev \
+  libssl-dev wget curl gettext-base
+
+# ---------------------------------------------------------------------------
+# 2. Download and extract nginx
+# ---------------------------------------------------------------------------
+cd /tmp
+wget -q "http://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz"
+tar -xzf "nginx-${NGINX_VERSION}.tar.gz"
+cd "nginx-${NGINX_VERSION}"
+
+# ---------------------------------------------------------------------------
+# 3. Configure
+# ---------------------------------------------------------------------------
+./configure \
+  --prefix="$INSTALL_PATH" \
+  --sbin-path="$INSTALL_PATH/sbin/nginx" \
+  --conf-path="$INSTALL_PATH/nginx.conf" \
+  --pid-path="$INSTALL_PATH/nginx.pid" \
+  --lock-path="$INSTALL_PATH/nginx.lock" \
+  --with-http_ssl_module \
+  --with-stream \
+  --with-http_realip_module \
+  --with-http_v2_module \
+  --with-threads \
+  --with-file-aio \
+  --with-http_stub_status_module
+
+# ---------------------------------------------------------------------------
+# 4. Build and install
+# ---------------------------------------------------------------------------
+make -j"$(nproc)"
+make install
+
+# ---------------------------------------------------------------------------
+# 5. systemd service — EnvironmentFile supplies the key at runtime
+# ---------------------------------------------------------------------------
+cat > "$SERVICE_FILE" <<EOL
+[Unit]
+Description=The NGINX HTTP and reverse proxy server
+After=network.target
+
+[Service]
+Type=forking
+PIDFile=${INSTALL_PATH}/nginx.pid
+EnvironmentFile=${RUNTIME_ENV}
+ExecStartPre=${INSTALL_PATH}/sbin/nginx -t
+ExecStart=${INSTALL_PATH}/sbin/nginx
+ExecReload=${INSTALL_PATH}/sbin/nginx -s reload
+ExecStop=${INSTALL_PATH}/sbin/nginx -s quit
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
+EOL
+
+# ---------------------------------------------------------------------------
+# 6. nginx.conf TEMPLATE. Note: the key is NOT interpolated here.
+#    `env upstream_api_key;` exposes the var; $upstream_api_key is resolved
+#    at request time from the master process environment.
+# ---------------------------------------------------------------------------
+cat > "$TEMPLATE_FILE" <<'EOL'
+worker_processes auto;
+
+# Expose the systemd-provided variable to nginx config.
+env upstream_api_key;
+
+events { worker_connections 1024; }
+
+http {
+    # Map the environment variable into a normal nginx variable.
+    map $upstream_api_key $api_key_value {
+        default $upstream_api_key;
+    }
+
+    server {
+        listen ${LISTEN_PORT};
+        server_name _;
+
+        location /model-api/ {
+            # Key injected at runtime; never present in this file.
+            proxy_set_header Authorization "Bearer $api_key_value";
+
+            proxy_pass ${UPSTREAM_URL};
+            proxy_http_version 1.1;
+            proxy_set_header Host              $host;
+            proxy_set_header X-Real-IP         $remote_addr;
+            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Connection        "";
+        }
+    }
+}
+EOL
+
+# ---------------------------------------------------------------------------
+# 7. Render. UPSTREAM_API_KEY is DELIBERATELY excluded from the whitelist.
+# ---------------------------------------------------------------------------
+( umask 077 && \
+  envsubst '$LISTEN_PORT $UPSTREAM_URL' < "$TEMPLATE_FILE" > /tmp/nginx.conf )
+install -m 644 -o root -g root /tmp/nginx.conf "$INSTALL_PATH/nginx.conf"
+
+rm -f "$TEMPLATE_FILE" /tmp/nginx.conf
+
+# ---------------------------------------------------------------------------
+# 8. Validate and start
+# ---------------------------------------------------------------------------
+"$INSTALL_PATH/sbin/nginx" -t
+
+if [[ "$UPSTREAM_API_KEY" == "$DEFAULT_API_KEY" ]]; then
+  warn "Still using placeholder key; configure Vault, AWS, or a local source."
+else
+  log "Key resolved and stored only in $RUNTIME_ENV (chmod 600)."
+  log "nginx.conf contains no secret and is world-readable (644) on purpose."
+fi
+
+log "NGINX install complete (key kept off disk in nginx.conf)."