46 lines
1.5 KiB
Bash
Executable File
46 lines
1.5 KiB
Bash
Executable File
#!/bin/bash
|
|
# Agent communication capability layer initialization script
|
|
# Sets up the ACL tmpfs key directory. The dispatcher mounts
|
|
# /opt/harness/bin/acl-finalize directly (AC-2).
|
|
|
|
set -euo pipefail
|
|
|
|
echo "Initializing agent-communication capability layer..."
|
|
|
|
# Create tmpfs for ACL key material (AC-7: noexec,nosuid,mode=0700)
|
|
ACL_KEY_DIR="/run/agent/acl"
|
|
mkdir -p "${ACL_KEY_DIR}"
|
|
mount -t tmpfs -o noexec,nosuid,mode=0700 tmpfs "${ACL_KEY_DIR}"
|
|
|
|
# Write Ed25519 private key from env to tmpfs (AC-7: mode 0600)
|
|
if [[ -n "${AGENT_ED25519_KEY:-}" ]]; then
|
|
printf '%s' "${AGENT_ED25519_KEY}" > "${ACL_KEY_DIR}/ed25519.key"
|
|
chmod 0600 "${ACL_KEY_DIR}/ed25519.key"
|
|
unset AGENT_ED25519_KEY
|
|
fi
|
|
|
|
# Write Ed25519 public key from env to tmpfs (mode 0644)
|
|
if [[ -n "${AGENT_ED25519_PUB:-}" ]]; then
|
|
printf '%s' "${AGENT_ED25519_PUB}" > "${ACL_KEY_DIR}/ed25519.pub"
|
|
chmod 0644 "${ACL_KEY_DIR}/ed25519.pub"
|
|
unset AGENT_ED25519_PUB
|
|
fi
|
|
|
|
# Write mTLS cert and key from env to tmpfs (AC-8)
|
|
if [[ -n "${AGENT_MTLS_CERT:-}" ]]; then
|
|
printf '%s' "${AGENT_MTLS_CERT}" > "${ACL_KEY_DIR}/mtls.crt"
|
|
chmod 0600 "${ACL_KEY_DIR}/mtls.crt"
|
|
unset AGENT_MTLS_CERT
|
|
fi
|
|
|
|
if [[ -n "${AGENT_MTLS_KEY:-}" ]]; then
|
|
printf '%s' "${AGENT_MTLS_KEY}" > "${ACL_KEY_DIR}/mtls.key"
|
|
chmod 0600 "${ACL_KEY_DIR}/mtls.key"
|
|
unset AGENT_MTLS_KEY
|
|
fi
|
|
|
|
# Ensure /opt/harness/bin/ exists (dispatcher mounts acl-finalize here)
|
|
mkdir -p /opt/harness/bin
|
|
|
|
echo "Agent communication environment ready"
|