admin
2ca0643439
Reads the three _FILE-convention secrets (mounted by Swarm from Docker secrets provisioned by Woodpecker — see secrets/flowagent.secrets.example), performs `az login --service-principal`, then execs into whatever command mcpo invokes (node /app/flowagent/mcp.mjs). No secret value is ever written to disk outside the ephemeral Docker secret mount, logged, or baked into the image.
31 lines
1.0 KiB
Bash
31 lines
1.0 KiB
Bash
#!/bin/sh
|
|
# FlowAgent MCP entrypoint — non-interactive Azure service-principal login.
|
|
#
|
|
# Expects three env vars pointing at Docker secret files (Pattern C,
|
|
# _FILE convention, provisioned by Woodpecker — never hand-typed):
|
|
# FLOWAGENT_AZURE_CLIENT_ID_FILE
|
|
# FLOWAGENT_AZURE_TENANT_ID_FILE
|
|
# FLOWAGENT_AZURE_CLIENT_SECRET_FILE
|
|
#
|
|
# On success, execs into the real command (node /app/flowagent/mcp.mjs),
|
|
# replacing this shell so mcpo's stdio pipe talks directly to the MCP process.
|
|
set -eu
|
|
|
|
: "${FLOWAGENT_AZURE_CLIENT_ID_FILE:?FLOWAGENT_AZURE_CLIENT_ID_FILE not set}"
|
|
: "${FLOWAGENT_AZURE_TENANT_ID_FILE:?FLOWAGENT_AZURE_TENANT_ID_FILE not set}"
|
|
: "${FLOWAGENT_AZURE_CLIENT_SECRET_FILE:?FLOWAGENT_AZURE_CLIENT_SECRET_FILE not set}"
|
|
|
|
CLIENT_ID="$(cat "$FLOWAGENT_AZURE_CLIENT_ID_FILE")"
|
|
TENANT_ID="$(cat "$FLOWAGENT_AZURE_TENANT_ID_FILE")"
|
|
CLIENT_SECRET="$(cat "$FLOWAGENT_AZURE_CLIENT_SECRET_FILE")"
|
|
|
|
az login --service-principal \
|
|
-u "$CLIENT_ID" \
|
|
-p "$CLIENT_SECRET" \
|
|
--tenant "$TENANT_ID" \
|
|
--output none
|
|
|
|
unset CLIENT_SECRET
|
|
|
|
exec "$@"
|