Add new bin/ops scripts

[rahearn]

Story

As a devops engineer,
I would like to script some currently manual tasks,
So that I can stop making mistakes the first time I set up an environment

Solution

Tasks

Preview Give feedback

1. tf_to_aws_env script - set up ENV vars so that aws s3 commands work given the secrets.backend.tfvars file
2. tf_to_gh_env script - set up github actions environment secrets from secrets.backend.tfvars and secrets.cicd.tfvars
3. investigate possibility of tf_to_circleci_env script

Acceptance Criteria

• can add all secrets values needed for deployment to a github environment in a single script

[rahearn]

fish version of tf_to_aws_env:

function tf_to_aws_env --description 'Set AWS credentials with a backend tfvars file' --argument file
    if test -z $file
      set file secrets.backend.tfvars
    end

    echo "Setting AWS credentials for with $file…"

    set -gx AWS_ACCESS_KEY_ID (parse_tfsecrets access_key $file)
    set -gx AWS_SECRET_ACCESS_KEY (parse_tfsecrets secret_key $file)
    set -gx AWS_DEFAULT_REGION (parse_tfsecrets region $file)
    set -gx BUCKET_NAME (parse_tfsecrets bucket $file)
end

[rahearn]

fish version of tf_to_gh_env:

function tf_to_gh_env --description 'Set GitHub environment secrets from backend and cicd tfvars files' --argument env_name
    if test -z $env_name
      echo "env_name must be set"
      return 1
    end

    if ! test -f secrets.backend.tfvars
      echo "secrets.backend.tfvars must be in current working directory"
      return 1
    end

    if ! test -f secrets.cicd.tfvars
      echo "secrets.cicd.tfvars must be in current working directory"
      return 1
    end

    echo "Setting GH credentials for $env_name"

    if test "$env_name" = "production"
      gh secret set RAILS_MASTER_KEY -e $env_name < ../config/credentials/production.key
    else
      gh secret set RAILS_MASTER_KEY -e $env_name < ../config/master.key
    end

    parse_tfsecrets access_key secrets.backend.tfvars | gh secret set TERRAFORM_STATE_ACCESS_KEY -e $env_name
    parse_tfsecrets secret_key secrets.backend.tfvars | gh secret set TERRAFORM_STATE_SECRET_ACCESS_KEY -e $env_name
    parse_tfsecrets bucket secrets.backend.tfvars | gh secret set TERRAFORM_STATE_BUCKET_NAME -e $env_name

    parse_tfsecrets cf_user secrets.cicd.tfvars | gh secret set CF_USERNAME -e $env_name
    parse_tfsecrets cf_password secrets.cicd.tfvars | gh secret set CF_PASSWORD -e $env_name
end

[rahearn]

CircleCI docs:

• https://circleci.com/docs/api/v2/index.html#tag/Project/operation/createEnvVar
• https://circleci.com/docs/2.0/local-cli/