20035: Fixes systemd unit Exec* value quoting.

[arvados.git] / tools / salt-install / installer.sh

diff --git a/tools/salt-install/installer.sh b/tools/salt-install/installer.sh
index 5f6e7a038182a1b3c2c66834de28cc2a00430761..21f36faace2934007d7e404ca8ed09c9f9c64dd3 100755 (executable)
--- a/tools/salt-install/installer.sh
+++ b/tools/salt-install/installer.sh
@@ -14,6 +14,7 @@
 #
 
 set -eu
+set -o pipefail
 
 # The parameter file
 declare CONFIG_FILE=local.params
@@ -72,12 +73,12 @@ sync() {
            # and then clone a regular repository (with a checkout)
            # from that.
 
-           ssh $DEPLOY_USER@$NODE git init --bare ${GITTARGET}.git
+           ssh $DEPLOY_USER@$NODE git init --bare --shared=0600 ${GITTARGET}.git
            if ! git remote add $NODE $DEPLOY_USER@$NODE:${GITTARGET}.git ; then
                        git remote set-url $NODE $DEPLOY_USER@$NODE:${GITTARGET}.git
            fi
            git push $NODE $BRANCH
-           ssh $DEPLOY_USER@$NODE git clone ${GITTARGET}.git ${GITTARGET}
+           ssh $DEPLOY_USER@$NODE "umask 0077 && git clone ${GITTARGET}.git ${GITTARGET}"
        fi
 
        # The update case.
@@ -107,7 +108,7 @@ deploynode() {
     logfile=deploy-${NODE}-$(date -Iseconds).log
 
     if [[ "$NODE" = localhost ]] ; then
-       SUDO=''
+           SUDO=''
        if [[ $(whoami) != 'root' ]] ; then
            SUDO=sudo
        fi
@@ -171,7 +172,7 @@ case "$subcmd" in
        fi
 
        echo "Initializing $SETUPDIR"
-       git init $SETUPDIR
+       git init --shared=0600 $SETUPDIR
        cp -r *.sh tests $SETUPDIR
 
        cp local.params.example.$PARAMS $SETUPDIR/${CONFIG_FILE}
@@ -204,7 +205,8 @@ case "$subcmd" in
        logfile=terraform-$(date -Iseconds).log
        (cd terraform/vpc && terraform apply) 2>&1 | tee -a $logfile
        (cd terraform/data-storage && terraform apply) 2>&1 | tee -a $logfile
-       (cd terraform/services && terraform apply) 2>&1 | tee -a $logfile
+       (cd terraform/services && terraform apply) 2>&1 | grep -v letsencrypt_iam_secret_access_key | tee -a $logfile
+       (cd terraform/services && echo -n 'letsencrypt_iam_secret_access_key = ' && terraform output letsencrypt_iam_secret_access_key) 2>&1 | tee -a $logfile
        ;;
 
     generate-tokens)