Secrets setup script

Interactive script that generates all Kubernetes secrets and a values.yaml for your Scalekit deployment.

The setup script is a one-time tool for initial deployment. Run it once to bootstrap your cluster — do not run it again on an existing installation.

It collects your configuration interactively and produces two output files:

A secrets script (scalekit-secrets-<env>-<timestamp>.sh) — runs kubectl commands to create all five required Kubernetes secrets
A values file (values-<env>-<timestamp>.yaml) — paste this into the Scalekit distribution portal when creating your deployment

Prerequisites

Tool	Version	Purpose
`bash`	4.0 or later	Run the script
`openssl`	Any modern version	Generate cryptographic keys and tokens
`python3`	3.6 or later	Generate webhook JWT and OIDC client secret
`kubectl`	1.27 or later	Create Kubernetes secrets in your cluster

kubectl must be configured and pointed at the cluster you are deploying to before you run the script.

On macOS, bash ships as version 3. Install a newer version with Homebrew:

1
brew install bash

Run the script

Copy the script below, save it as setup-secrets.sh, make it executable, then run it:

1
chmod +x setup-secrets.sh
2
bash setup-secrets.sh

When prompted to choose an environment, enter the number that matches your target:

Option	Environment	Notes
`1`	Minikube (local)	Uses nginx ingress; sets `http` protocol and `allow_insecure: true`
`2`	GCP / GKE	Configures GKE Gateway API and NEG annotations
`3`	Other Kubernetes cluster	Generic config — you add your own ingress or gateway
`4`	Evaluation	Fast path: Helm spins up bundled PostgreSQL and Redis; only asks for webhook and registry credentials

Evaluation mode

Option 4 is a shortcut for a local or throwaway environment. The script asks only for a webhook JWT secret, a webhook API token, and a registry access token, then exits. It generates a minimal values-eval-<timestamp>.yaml to paste into the distribution portal. No databases or Redis instances are needed — the chart provides bundled ones.

Do not use evaluation mode in production. The bundled databases have no backups, no replication, and no persistent storage guarantees.

Optional flags

Flag	Effect
`--enable-openfga`	Includes OpenFGA secrets and database configuration
`--change-defaults`	Prompts you to confirm or override default values instead of accepting them silently

What the script collects

Full setup (options 1, 2, 3)

The script walks through these sections:

Section	What it asks
Namespace	Kubernetes namespace to deploy into
Environment	Deployment target: Minikube, GCP/GKE, other K8s, or Evaluation
PostgreSQL	Host, port, credentials, and database names (scalekit, webhooks, openfga if enabled)
Redis	Host, port, password, and db indexes for app, background jobs, and webhooks
Email (SMTP)	From address, host, port, username, and password
Container registry	Registry token from the Scalekit distribution portal; server defaults to `ar.scalekit.cloud`
GKE Gateway	GatewayClass name and GCP certificate map (GCP/GKE only)
App settings	Domain, region, replica count
Admin user	First name, last name, email for the initial dashboard login

All cryptographic values (OIDC keys, cookie keys, webhook JWT, etc.) are auto-generated — you do not supply these.

Evaluation mode (option 4)

The script only asks for:

Section	What it asks
Namespace	Kubernetes namespace to deploy into
Webhook credentials	JWT secret and API token
Container registry	Registry access token

After the script completes

The script prints the paths to both generated files. Before proceeding:

Run the secrets script to create all Kubernetes secrets:
Terminal window
```
1
bash scalekit-secrets-<env>-<timestamp>.sh
```
Paste the contents of values-<env>-<timestamp>.yaml into the Scalekit distribution portal when creating or updating your deployment — see Install Scalekit for the full portal flow.

Script

1
#!/usr/bin/env bash
2
set -euo pipefail
3

4
# ── Arguments ─────────────────────────────────────────────────────────────────
5
# Usage: bash setup-secrets.sh [--enable-openfga] [--change-defaults]
6
OPENFGA_ENABLED="false"
7
CHANGE_DEFAULTS="false"
8
for arg in "$@"; do
9
  case "$arg" in
10
    --enable-openfga)  OPENFGA_ENABLED="true" ;;
11
    --change-defaults) CHANGE_DEFAULTS="true" ;;
12
    *) echo "Unknown argument: $arg"; exit 1 ;;
13
  esac
14
done
15

16
# ── Colours ──────────────────────────────────────────────────────────────────
17
BOLD=$'\033[1m'
18
DIM=$'\033[2m'
19
RED=$'\033[31m'
20
GREEN=$'\033[32m'
21
YELLOW=$'\033[33m'
22
CYAN=$'\033[36m'
23
RESET=$'\033[0m'
24

25
header()  { echo "\n${BOLD}${CYAN}▶ $*${RESET}"; }
26
prompt()  { echo "${YELLOW}$*${RESET}"; }
27
success() { echo "${GREEN}✓ $*${RESET}"; }
28
dim()     { echo "${DIM}$*${RESET}"; }
29

30
ask() {
31
  local var="$1" msg="$2" default="${3:-}"
32
  # If a default exists and --change-defaults is not set, use it silently
33
  if [[ -n "$default" && "$CHANGE_DEFAULTS" == "false" ]]; then
34
    eval "$var=\"$default\""
35
    dim "  $msg = $default (default)"
36
    return
37
  fi
38
  while true; do
39
    if [[ -n "$default" ]]; then
40
      read -rp "${YELLOW}$msg [${default}]: ${RESET}" input
41
    else
42
      read -rp "${YELLOW}$msg: ${RESET}" input
43
    fi
44
    if [[ -z "$input" && -n "$default" ]]; then
45
      eval "$var=\"$default\""
46
      break
47
    elif [[ -n "$input" ]]; then
48
      eval "$var=\"$input\""
49
      break
50
    else
51
      echo "${RED}  ✗ This field is required. Please enter a value.${RESET}"
52
    fi
53
  done
54
}
55

56
ask_secret() {
57
  local var="$1" msg="$2" default="${3:-}"
58
  # If the 3rd argument was explicitly passed (even as ""), empty input is allowed
59
  local allow_empty="${3+yes}"
60
  while true; do
61
    if [[ -n "$default" ]]; then
62
      read -rp "${YELLOW}$msg [${default}]: ${RESET}" input
63
    else
64
      read -rp "${YELLOW}$msg: ${RESET}" input
65
    fi
66
    if [[ -z "$input" && -n "$default" ]]; then
67
      eval "$var=\"$default\""
68
      break
69
    elif [[ -z "$input" && "$allow_empty" == "yes" ]]; then
70
      eval "$var=\"\""
71
      break
72
    elif [[ -n "$input" ]]; then
73
      eval "$var=\"$input\""
74
      break
75
    else
76
      echo "${RED}  ✗ This field is required. Please enter a value.${RESET}"
77
    fi
78
  done
79
}
80

81
# ── Step 1: Namespace & environment ──────────────────────────────────────────
82
header "Step 1 — Namespace & environment"
83
ask NAMESPACE "Kubernetes namespace to deploy Scalekit into"
84
echo
85
echo -e "${YELLOW}Which environment are you deploying to?${RESET}"
86
echo "  1) Minikube (local)"
87
echo "  2) GCP / GKE"
88
echo "  3) Other Kubernetes cluster"
89
echo "  4) Evaluation (quickstart — Helm brings up PostgreSQL & Redis)"
90
read -rp "${YELLOW}Enter 1, 2, 3 or 4: ${RESET}" ENV_CHOICE
91
if [[ "$ENV_CHOICE" == "1" ]]; then
92
  ENV_LABEL="minikube"
93
elif [[ "$ENV_CHOICE" == "2" ]]; then
94
  ENV_LABEL="gke"
95
elif [[ "$ENV_CHOICE" == "4" ]]; then
96
  ENV_LABEL="eval"
97
else
98
  ENV_LABEL="k8s"
99
fi
100

101
# ── Evaluation flow (early exit) ──────────────────────────────────────────────
102
if [[ "$ENV_CHOICE" == "4" ]]; then
103
  header "Step 2 — Evaluation setup"
104
  dim "  Helm will spin up PostgreSQL and Redis automatically."
105
  dim "  You only need a Svix API token and registry credentials."
106
  echo
107

108
  ask_secret SVIX_JWT_SECRET   "  Svix JWT secret (must be the secret used to sign the API token)"
109
  ask_secret SVIX_API_KEY      "  Svix API token (JWT signed with the above secret)"
110
  ask_secret REGISTRY_PASSWORD "  Registry access token"
111
  echo
112

113
  VALUES_FILE="$(pwd)/values-eval-$(date +%Y%m%d%H%M%S).yaml"
114
  cat > "$VALUES_FILE" <<EOF
115
secrets:
116
  create: true
117
  svix:
118
    jwtSecret: "${SVIX_JWT_SECRET}"
119
    apiToken: "${SVIX_API_KEY}"
120
  registry:
121
    password: "${REGISTRY_PASSWORD}"
122

123
postgresql:
124
  enabled: true
125

126
redis:
127
  enabled: true
128
EOF
129

130
  success "values.yaml written to: $VALUES_FILE"
131
  echo
132

133
  header "Step 3 — Helm install"
134
  ask CHART_VERSION "  Chart version to install (e.g. 0.1.0)"
135
  echo
136

137
  header "Done"
138
  echo
139
  success "values.yaml : $VALUES_FILE"
140
  echo
141
  echo -e "${BOLD}${CYAN}┌─────────────────────────────────────────────────────────────┐${RESET}"
142
  echo -e "${BOLD}${CYAN}│              execute the following command                   │${RESET}"
143
  echo -e "${BOLD}${CYAN}└─────────────────────────────────────────────────────────────┘${RESET}"
144
  echo
145
  echo "  helm install scalekit oci://ar.scalekit.cloud/scalekit/charts/scalekit \\"
146
  echo "    --version ${CHART_VERSION} \\"
147
  echo "    -n ${NAMESPACE} \\"
148
  echo "    --values=${VALUES_FILE}"
149
  echo
150
  echo -e "${BOLD}${CYAN}└─────────────────────────────────────────────────────────────┘${RESET}"
151
  exit 0
152
fi
153

154
# ── Step 2: Auto-generate values ─────────────────────────────────────────────
155
header "Step 2 — Generating secure values"
156

157
OIDC_MASTER_KEY=$(openssl rand -hex 16)
158
SECURECOOKIE_ENCRYPTKEY=$(openssl rand -hex 16)
159
SECURECOOKIE_HASHKEY=$(openssl rand -hex 16)
160
SVIX_JWT_SECRET=$(openssl rand -base64 32)
161
SVIX_MAIN_SECRET=$(openssl rand -base64 32)
162
TRAEFIK_TOKEN=$(openssl rand -hex 16)
163
FGA_API_TOKEN=$(openssl rand -hex 24)
164
OPENFGA_EXTRA_KEY=$(openssl rand -hex 24)
165
APP_OIDC_CLIENT_ID="skc_8573429015935040"
166

167
APP_OIDC_CLIENT_SECRET=$(python3 -c "
168
import secrets
169
print(f'sk_{secrets.token_urlsafe(48)}')
170
")
171

172
success "Generated: oidc_master_key, securecookie keys, svix secrets, traefik token, fga tokens, oidc client id/secret"
173

174
# ── Step 3: Svix JWT ──────────────────────────────────────────────────────────
175
header "Step 3 — Svix JWT token"
176
dim "The Svix API token is a JWT signed with the generated svix_jwt_secret."
177

178
SVIX_SUB=$(python3 -c "
179
import secrets, string
180
chars = string.ascii_letters + string.digits
181
print('org_' + ''.join(secrets.choice(chars) for _ in range(22)))
182
")
183

184
SVIX_API_KEY=$(python3 -c "
185
import base64, hashlib, hmac as _hmac, json, time
186

187
secret = '''${SVIX_JWT_SECRET}'''
188
sub    = '${SVIX_SUB}'
189
now    = int(time.time())
190
exp    = now + 315360000  # 10 years
191

192
header  = base64.urlsafe_b64encode(json.dumps({'alg':'HS256','typ':'JWT'}, separators=(',',':')).encode()).rstrip(b'=').decode()
193
payload = base64.urlsafe_b64encode(json.dumps({'iat':now,'exp':exp,'nbf':now,'iss':'svix-server','sub':sub}, separators=(',',':')).encode()).rstrip(b'=').decode()
194
msg     = f'{header}.{payload}'
195
sig     = base64.urlsafe_b64encode(_hmac.new(secret.encode(), msg.encode(), hashlib.sha256).digest()).rstrip(b'=').decode()
196
print(f'{msg}.{sig}')
197
")
198

199
success "Svix JWT token generated (used as svix_api_key and svix-secrets api-token)"
200

201
# ── Step 4: Collect user-provided values ─────────────────────────────────────
202
header "Step 4 — Required configuration"
203
dim "  The following sections collect everything needed to configure Scalekit's"
204
dim "  services and generate all Kubernetes secrets and the values.yaml file."
205
echo
206

207
# ── Database ──────────────────────────────────────────────────────────────────
208
header "  [Database] PostgreSQL"
209
dim "  Scalekit uses a shared PostgreSQL server with one set of credentials"
210
dim "  across all components. Each component gets its own database."
211
dim ""
212
dim "  These values will be used to:"
213
dim "    - create the 'db-migrations' secret  (DATABASE_URL, DB_ADAPTER)"
214
dim "    - create the 'authentication-secret' (database_password)"
215
dim "    - create the 'svix-secrets'          (db-dsn)"
216
if [[ "$OPENFGA_ENABLED" == "true" ]]; then
217
dim "    - create the 'openfga-secrets'       (uri, password, username)"
218
fi
219
dim ""
220
dim "  All databases must already exist on your server before running helm install."
221
echo
222

223
ask        DB_HOST           "  PostgreSQL host (IP or hostname)"
224
read -rp "${YELLOW}  PostgreSQL port [5432]: ${RESET}" input; DB_PORT="${input:-5432}"
225
ask        DB_USER           "  PostgreSQL username"
226
ask_secret DATABASE_PASSWORD "  PostgreSQL password"
227
echo
228
dim "  Database names — each component gets its own isolated database:"
229
ask DB_NAME_SCALEKIT  "  Scalekit main application database name" "scalekit"
230
ask DB_NAME_SVIX      "  Svix webhooks database name" "webhooks"
231
if [[ "$OPENFGA_ENABLED" == "true" ]]; then
232
  ask DB_NAME_OPENFGA "  OpenFGA authorization database name" "openfga"
233
fi
234
echo
235

236
# Construct all DB URLs from shared credentials
237
DATABASE_URL="postgresql://${DB_USER}:${DATABASE_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_NAME_SCALEKIT}"
238
SVIX_DB_DSN="postgresql://${DB_USER}:${DATABASE_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_NAME_SVIX}"
239
if [[ "$OPENFGA_ENABLED" == "true" ]]; then
240
  OPENFGA_DB_URI="postgresql://${DB_USER}:${DATABASE_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_NAME_OPENFGA}"
241
fi
242

243
# ── Redis ─────────────────────────────────────────────────────────────────────
244
header "  [Redis]"
245
dim "  Redis powers three isolated workloads — main app cache, the Asynq"
246
dim "  background job queue, and the Svix webhook message bus. All three share"
247
dim "  the same server but use different database indexes to stay isolated."
248
dim ""
249
dim "  These values will be used to:"
250
dim "    - set redis/asynq config in values.yaml"
251
dim "    - create the 'authentication-secret' (redis_password, asynq_redis_password)"
252
dim "    - create the 'svix-secrets'          (redis-dsn)"
253
dim ""
254
dim "  Leave password empty if your Redis instance has no auth configured."
255
echo
256

257
ask        REDIS_HOST     "  Redis host (IP or hostname)"
258
read -rp "${YELLOW}  Redis port [6379]: ${RESET}" input; REDIS_PORT="${input:-6379}"
259
ask_secret REDIS_PASSWORD "  Redis password (leave empty if none)" ""
260
ASYNQ_REDIS_PASSWORD="$REDIS_PASSWORD"
261
echo
262
dim "  Database indexes — each component gets its own slot to avoid key collisions:"
263
ask REDIS_DB       "  Redis db index for main application" "10"
264
ask ASYNQ_REDIS_DB "  Redis db index for Asynq background jobs" "12"
265
ask SVIX_REDIS_DB  "  Redis db index for Svix webhooks" "11"
266

267
SVIX_REDIS_DSN="redis://${REDIS_PASSWORD:+:${REDIS_PASSWORD}@}${REDIS_HOST}:${REDIS_PORT}/${SVIX_REDIS_DB}#insecure"
268
echo
269

270
# ── Email ─────────────────────────────────────────────────────────────────────
271
EMAIL_KEY="na"
272
SENDGRID_KEY="na"
273
POSTMARK_KEY="na"
274

275
header "  [Email] Outbound SMTP"
276
dim "  Scalekit sends transactional emails (invites, magic links, verification"
277
dim "  codes) via SMTP."
278
dim ""
279
dim "  These values will be used to:"
280
dim "    - set seedData.emailServer in values.yaml (from, host, port, username)"
281
echo
282

283
ask        EMAIL_FROM      "  Sender email address (e.g. hi@yourdomain.com)"
284
ask        EMAIL_FROM_NAME "  Sender display name (e.g. Team Scalekit)"
285
ask_secret SMTP_HOST       "  SMTP server host" "smtp.postmarkapp.com"
286
ask_secret SMTP_PORT       "  SMTP server port" "587"
287
ask        SMTP_USERNAME   "  SMTP login username"
288
ask_secret SMTP_PASSWORD   "  SMTP login password"
289
echo
290

291
# ── Image Registry ────────────────────────────────────────────────────────────
292
header "  [Registry] Container Image Registry"
293
dim "  Scalekit images are hosted on a private registry at ar.scalekit.cloud."
294
dim "  Kubernetes needs a pull secret with your access token to download images."
295
dim ""
296
dim "  These values will be used to:"
297
dim "    - create the 'artifact-registry-secret' (docker-registry pull secret)"
298
echo
299

300
ask        REGISTRY_SERVER   "  Container registry server URL" "ar.scalekit.cloud"
301
dim "  Registry username is always: oauth2accesstoken"
302
REGISTRY_USERNAME="oauth2accesstoken"
303
ask_secret REGISTRY_PASSWORD "  Registry access token (your personal or service account token)"
304
echo
305

306
# ── GKE Gateway (GCP only) ────────────────────────────────────────────────────
307
if [[ "$ENV_CHOICE" == "2" ]]; then
308
  header "  [GKE Gateway]"
309
  dim "  On GKE, all external traffic enters through a Google-managed L7 gateway."
310
  dim ""
311
  dim "  These values will be used to:"
312
  dim "    - set gateway.className and networking.gke.io/certmap in values.yaml"
313
  echo
314
  ask GATEWAY_CLASS "  GKE gateway class name" "gke-l7-global-external-managed"
315
  ask CERT_MAP_NAME "  GCP certificate map name covering your domain (networking.gke.io/certmap)"
316
  echo
317
fi
318

319
# ── App ───────────────────────────────────────────────────────────────────────
320
header "  [App] Application settings"
321
dim "  The base domain is used to derive all subdomains (app.*, auth.*). Region"
322
dim "  controls data residency labelling. Replica count sets pods per service."
323
if [[ "$ENV_CHOICE" == "1" ]]; then
324
  dim "  Minikube default: scalekit.local (local testing only, not internet-reachable)."
325
fi
326
dim ""
327
dim "  These values will be used to:"
328
dim "    - set scalekit.config.app.* in values.yaml  (domain, protocol, region)"
329
dim "    - set replicaCount in values.yaml"
330
echo
331

332
if [[ "$ENV_CHOICE" == "1" ]]; then
333
  ask APP_DOMAIN    "  Application base domain (subdomains app.* and auth.* will be derived from this)" "scalekit.local"
334
  APP_PROTOCOL="http"
335
  OIDC_ALLOW_INSECURE="true"
336
else
337
  ask APP_DOMAIN    "  Application base domain (e.g. onprem.scalekit.cloud)"
338
  APP_PROTOCOL="https"
339
  OIDC_ALLOW_INSECURE="false"
340
fi
341
ask APP_REGION    "  Deployment region for data residency labelling (e.g. us, eu)" "us"
342
ask REPLICA_COUNT "  Number of pod replicas per service" "2"
343
echo
344

345
# ── Admin seed user ───────────────────────────────────────────────────────────
346
header "  [Admin] Seed admin user"
347
dim "  This account is created automatically on first boot. Use it to log in"
348
dim "  to the Scalekit dashboard and set up your workspace."
349
dim ""
350
dim "  These values will be used to:"
351
dim "    - set seedData.adminUser.* in values.yaml  (firstName, lastName, email)"
352
echo
353

354
ask ADMIN_FIRST_NAME "  Admin user first name"
355
ask ADMIN_LAST_NAME  "  Admin user last name"
356
ask ADMIN_EMAIL      "  Admin user email address (used to log in to the dashboard)"
357
echo
358

359

360
# ── Step 5: Summary ───────────────────────────────────────────────────────────
361
header "Step 5 — Review all values"
362
echo
363
echo -e "${DIM}Auto-generated:${RESET}"
364
echo "  traefik_token             = $TRAEFIK_TOKEN"
365
echo "  oidc_master_key           = $OIDC_MASTER_KEY"
366
echo "  securecookie_encryptkey   = $SECURECOOKIE_ENCRYPTKEY"
367
echo "  securecookie_hashkey      = $SECURECOOKIE_HASHKEY"
368
echo "  svix_jwt_secret           = $SVIX_JWT_SECRET"
369
echo "  svix_main_secret          = $SVIX_MAIN_SECRET"
370
echo "  svix_api_key              = $SVIX_API_KEY"
371
echo "  fga_api_token             = $FGA_API_TOKEN"
372
echo "  openfga_extra_key         = $OPENFGA_EXTRA_KEY"
373
echo "  app_oidc_client_id        = $APP_OIDC_CLIENT_ID"
374
echo "  app_oidc_client_secret    = $APP_OIDC_CLIENT_SECRET"
375
echo
376
echo -e "${DIM}Database (shared credentials):${RESET}"
377
echo "  host                      = $DB_HOST:$DB_PORT"
378
echo "  username                  = $DB_USER"
379
echo "  password                  = $DATABASE_PASSWORD"
380
echo "  scalekit db               = $DB_NAME_SCALEKIT  →  $DATABASE_URL"
381
echo "  svix db                   = $DB_NAME_SVIX      →  $SVIX_DB_DSN"
382
if [[ "$OPENFGA_ENABLED" == "true" ]]; then
383
  echo "  openfga db                = $DB_NAME_OPENFGA   →  $OPENFGA_DB_URI"
384
fi
385
echo
386
echo -e "${DIM}Provided by you:${RESET}"
387
echo "  namespace                 = $NAMESPACE"
388
echo "  environment               = $ENV_LABEL"
389
echo "  redis host:port           = $REDIS_HOST:$REDIS_PORT"
390
echo "  redis password            = ${REDIS_PASSWORD:-<empty>}"
391
echo "  redis.db (main)           = $REDIS_DB"
392
echo "  redis.db (asynq)          = $ASYNQ_REDIS_DB"
393
echo "  redis.db (svix)           = $SVIX_REDIS_DB  →  $SVIX_REDIS_DSN"
394
echo "  email_key                 = na (fixed)"
395
echo "  smtp password             = $SMTP_PASSWORD"
396
echo "  sendgrid_key              = na (fixed)"
397
echo "  smtp from                 = $EMAIL_FROM_NAME <$EMAIL_FROM>"
398
echo "  smtp host:port            = $SMTP_HOST:$SMTP_PORT"
399
echo "  smtp username             = $SMTP_USERNAME"
400
echo "  app.domain                = $APP_DOMAIN"
401
echo "  app.region                = $APP_REGION"
402
echo "  app.protocol              = $APP_PROTOCOL"
403
echo "  replicaCount              = $REPLICA_COUNT"
404
echo "  adminUser                 = $ADMIN_FIRST_NAME $ADMIN_LAST_NAME <$ADMIN_EMAIL>"
405
echo "  registry_server           = $REGISTRY_SERVER"
406
echo "  registry_password         = $REGISTRY_PASSWORD"
407
echo
408

409
# ── Step 6: Write secrets script ─────────────────────────────────────────────
410
OUTPUT_FILE="$(pwd)/scalekit-secrets-${ENV_LABEL}-$(date +%Y%m%d%H%M%S).sh"
411

412
cat > "$OUTPUT_FILE" <<EOF
413
#!/usr/bin/env bash
414
# Scalekit secrets setup — generated $(date)
415
# Environment: $ENV_LABEL | Namespace: $NAMESPACE
416

417
# Create namespace
418
kubectl create namespace $NAMESPACE
419

420
# authentication-service-token
421
kubectl create secret generic authentication-service-token \\
422
  --from-literal=TOKEN="$TRAEFIK_TOKEN" \\
423
  --dry-run=client -o yaml | kubectl apply -f - -n $NAMESPACE
424

425
# db-migrations
426
kubectl create secret generic db-migrations \\
427
  --from-literal=DATABASE_URL="$DATABASE_URL" \\
428
  --from-literal=DB_ADAPTER="postgresql" \\
429
  --dry-run=client -o yaml | kubectl apply -f - -n $NAMESPACE
430

431
# authentication-secret
432
kubectl create secret generic authentication-secret \\
433
  --from-literal=app_oidc_client_id="$APP_OIDC_CLIENT_ID" \\
434
  --from-literal=app_oidc_client_secret="$APP_OIDC_CLIENT_SECRET" \\
435
  --from-literal=email_key="$EMAIL_KEY" \\
436
  --from-literal=fga_config_api_token="$FGA_API_TOKEN" \\
437
  --from-literal=oidc_master_key="$OIDC_MASTER_KEY" \\
438
  --from-literal=postmark_key="$POSTMARK_KEY" \\
439
  --from-literal=database_password="$DATABASE_PASSWORD" \\
440
  --from-literal=asynq_redis_password="$ASYNQ_REDIS_PASSWORD" \\
441
  --from-literal=redis_password="$REDIS_PASSWORD" \\
442
  --from-literal=securecookie_encryptkey="$SECURECOOKIE_ENCRYPTKEY" \\
443
  --from-literal=securecookie_hashkey="$SECURECOOKIE_HASHKEY" \\
444
  --from-literal=sendgrid_key="$SENDGRID_KEY" \\
445
  --from-literal=app_scalekit_traefik_token="$TRAEFIK_TOKEN" \\
446
  --from-literal=svix_api_key="$SVIX_API_KEY" \\
447
  --from-literal=seed_data_email_server_settings_password="$SMTP_PASSWORD" \\
448
  --dry-run=client -o yaml | kubectl apply -f - -n $NAMESPACE
449

450
# svix-secrets
451
kubectl create secret generic svix-secrets \\
452
  --from-literal=db-dsn="$SVIX_DB_DSN" \\
453
  --from-literal=jwt-secret="$SVIX_JWT_SECRET" \\
454
  --from-literal=main-secret="$SVIX_MAIN_SECRET" \\
455
  --from-literal=redis-dsn="$SVIX_REDIS_DSN" \\
456
  --from-literal=api-token="$SVIX_API_KEY" \\
457
  --dry-run=client -o yaml | kubectl apply -f - -n $NAMESPACE
458

459
# artifact-registry-secret
460
kubectl create secret docker-registry artifact-registry-secret \\
461
  --docker-server="$REGISTRY_SERVER" \\
462
  --docker-username="$REGISTRY_USERNAME" \\
463
  --docker-password="$REGISTRY_PASSWORD" \\
464
  -n $NAMESPACE
465

466
# Verify all secrets are present
467
kubectl get secrets -n $NAMESPACE
468
EOF
469

470
if [[ "$OPENFGA_ENABLED" == "true" ]]; then
471
  cat >> "$OUTPUT_FILE" <<EOF
472

473
# openfga-secrets
474
kubectl create secret generic openfga-secrets \\
475
  --from-literal=keys="${OPENFGA_EXTRA_KEY},${FGA_API_TOKEN}" \\
476
  --from-literal=password="$DATABASE_PASSWORD" \\
477
  --from-literal=uri="$OPENFGA_DB_URI" \\
478
  --from-literal=username="$DB_USER" \\
479
  --dry-run=client -o yaml | kubectl apply -f - -n $NAMESPACE
480
EOF
481
fi
482

483
chmod +x "$OUTPUT_FILE"
484
success "Secrets script written to: $OUTPUT_FILE"
485

486
# ── Step 7: Generate values.yaml ─────────────────────────────────────────────
487
header "Step 7 — Generating values.yaml"
488

489
# Generate CSP header from protocol + domain
490
PROTO="$APP_PROTOCOL"
491
CDN1="${PROTO}://cdn.scalekit.com"
492
CDN2="${PROTO}://cdn.scalekit.cloud"
493
WILD="${PROTO}://*.${APP_DOMAIN}"
494

495
CSP_HEADER="default-src 'self' ${CDN1} ${CDN2} ${WILD}; "
496
CSP_HEADER+="style-src 'self' 'unsafe-inline' ${PROTO}://fonts.googleapis.com ${CDN1} ${CDN2} ${WILD}; "
497
CSP_HEADER+="script-src 'self' ${CDN1} ${CDN2} ${WILD}; "
498
CSP_HEADER+="connect-src 'self' ${CDN1} ${CDN2} ${WILD} wss://*.pusher.com; "
499
CSP_HEADER+="font-src ${PROTO}://fonts.gstatic.com; "
500
CSP_HEADER+="worker-src 'self' blob:; "
501
CSP_HEADER+="img-src 'self' ${PROTO}: data:; "
502
CSP_HEADER+="frame-src 'self' ${CDN1} ${CDN2} ${WILD};"
503

504
VALUES_FILE="$(pwd)/values-${ENV_LABEL}-$(date +%Y%m%d%H%M%S).yaml"
505

506
if [[ "$ENV_CHOICE" == "1" ]]; then
507
  cat > "$VALUES_FILE" <<EOF
508
replicaCount: ${REPLICA_COUNT}
509

510
scalekit:
511
  config:
512
    app:
513
      region: ${APP_REGION}
514
      domain: "${APP_DOMAIN}"
515
      protocol: "${APP_PROTOCOL}"
516
      oidc:
517
        allow_insecure: ${OIDC_ALLOW_INSECURE}
518
    database:
519
      host: "${DB_HOST}"
520
      name: "${DB_NAME_SCALEKIT}"
521
      user: "${DB_USER}"
522
      port: ${DB_PORT}
523
    redis:
524
      host: ${REDIS_HOST}
525
      port: ${REDIS_PORT}
526
      db: ${REDIS_DB}
527
    seedData:
528
      adminUser:
529
        firstName: "${ADMIN_FIRST_NAME}"
530
        lastName: "${ADMIN_LAST_NAME}"
531
        email: "${ADMIN_EMAIL}"
532
      emailServer:
533
        serverType: "SMTP"
534
        provider: "OTHER"
535
        enabled: true
536
        idOffset: 1
537
        settings:
538
          fromEmail: "${EMAIL_FROM}"
539
          fromName: "${EMAIL_FROM_NAME}"
540
          host: "${SMTP_HOST}"
541
          port: ${SMTP_PORT}
542
          username: "${SMTP_USERNAME}"
543

544
sidecars:
545
  dashboard:
546
    securityContext:
547
      runAsUser: 0
548
      runAsGroup: 0
549
    env:
550
      - name: CSP_HEADER
551
        value: "${CSP_HEADER}"
552
  svix:
553
    config:
554
      region: "${APP_REGION}"
555
      defaultRegion: "${APP_REGION}"
556

557
ingress:
558
  enabled: true
559
  className: "nginx"
560

561
resourceMetadata:
562
  ingress:
563
    annotations:
564
      nginx.ingress.kubernetes.io/proxy-buffer-size: "50m"
565
      nginx.ingress.kubernetes.io/proxy-buffers-number: "4"
566
      nginx.ingress.kubernetes.io/proxy-body-size: "50m"
567
EOF
568

569
elif [[ "$ENV_CHOICE" == "2" ]]; then
570
  cat > "$VALUES_FILE" <<EOF
571
replicaCount: ${REPLICA_COUNT}
572

573
scalekit:
574
  service:
575
    annotations:
576
      cloud.google.com/neg: '{"exposed_ports":{"8888":{}}}'
577
  config:
578
    app:
579
      region: ${APP_REGION}
580
      domain: "${APP_DOMAIN}"
581
    database:
582
      host: "${DB_HOST}"
583
      name: "${DB_NAME_SCALEKIT}"
584
      user: "${DB_USER}"
585
      port: ${DB_PORT}
586
    redis:
587
      host: ${REDIS_HOST}
588
      port: ${REDIS_PORT}
589
      db: ${REDIS_DB}
590
    seedData:
591
      adminUser:
592
        firstName: "${ADMIN_FIRST_NAME}"
593
        lastName: "${ADMIN_LAST_NAME}"
594
        email: "${ADMIN_EMAIL}"
595
      emailServer:
596
        serverType: "SMTP"
597
        provider: "OTHER"
598
        enabled: true
599
        idOffset: 1
600
        settings:
601
          fromEmail: "${EMAIL_FROM}"
602
          fromName: "${EMAIL_FROM_NAME}"
603
          host: "${SMTP_HOST}"
604
          port: ${SMTP_PORT}
605
          username: "${SMTP_USERNAME}"
606

607
sidecars:
608
  dashboard:
609
    service:
610
      annotations:
611
        cloud.google.com/neg: '{"exposed_ports":{"8000":{}}}'
612
    securityContext:
613
      runAsUser: 0
614
      runAsGroup: 0
615
    env:
616
      - name: CSP_HEADER
617
        value: "${CSP_HEADER}"
618
  flagd:
619
    service:
620
      annotations:
621
        cloud.google.com/neg: '{"exposed_ports":{"8016":{}}}'
622
  svix:
623
    service:
624
      annotations:
625
        cloud.google.com/neg: '{"exposed_ports":{"8071":{}}}'
626
    config:
627
      region: "${APP_REGION}"
628
      defaultRegion: "${APP_REGION}"
629
$(if [[ "$OPENFGA_ENABLED" == "true" ]]; then echo "  openfga:
630
    enabled: true
631
    # storeId: \"\"
632
    # modelId: \"\""; fi)
633

634
gateway:
635
  enabled: true
636
  provider: gcp
637
  className: "${GATEWAY_CLASS}"
638
  annotations:
639
    networking.gke.io/certmap: "${CERT_MAP_NAME}"
640
  redirectToHttps: true
641
  healthCheckPolicy:
642
    enabled: true
643
EOF
644

645
else
646
  cat > "$VALUES_FILE" <<EOF
647
replicaCount: ${REPLICA_COUNT}
648

649
scalekit:
650
  config:
651
    app:
652
      region: ${APP_REGION}
653
      domain: "${APP_DOMAIN}"
654
    database:
655
      host: "${DB_HOST}"
656
      name: "${DB_NAME_SCALEKIT}"
657
      user: "${DB_USER}"
658
      port: ${DB_PORT}
659
    redis:
660
      host: ${REDIS_HOST}
661
      port: ${REDIS_PORT}
662
      db: ${REDIS_DB}
663
    seedData:
664
      adminUser:
665
        firstName: "${ADMIN_FIRST_NAME}"
666
        lastName: "${ADMIN_LAST_NAME}"
667
        email: "${ADMIN_EMAIL}"
668
      emailServer:
669
        serverType: "SMTP"
670
        provider: "OTHER"
671
        enabled: true
672
        idOffset: 1
673
        settings:
674
          fromEmail: "${EMAIL_FROM}"
675
          fromName: "${EMAIL_FROM_NAME}"
676
          host: "${SMTP_HOST}"
677
          port: ${SMTP_PORT}
678
          username: "${SMTP_USERNAME}"
679

680
sidecars:
681
  dashboard:
682
    securityContext:
683
      runAsUser: 0
684
      runAsGroup: 0
685
    env:
686
      - name: CSP_HEADER
687
        value: "${CSP_HEADER}"
688
  svix:
689
    config:
690
      region: "${APP_REGION}"
691
      defaultRegion: "${APP_REGION}"
692
$(if [[ "$OPENFGA_ENABLED" == "true" ]]; then echo "  openfga:
693
    enabled: true
694
    # storeId: \"\"
695
    # modelId: \"\""; fi)
696
EOF
697
fi
698

699
success "values.yaml written to: $VALUES_FILE"
700

701
# ── Step 8: Helm install command ─────────────────────────────────────────────
702
header "Step 8 — Helm install"
703
ask CHART_VERSION "Which version of the Scalekit chart do you want to install? (e.g. 0.1.0)"
704

705
header "Done"
706
echo
707
success "Secrets script : $OUTPUT_FILE"
708
success "values.yaml    : $VALUES_FILE"
709
echo
710
echo -e "${BOLD}${CYAN}┌─────────────────────────────────────────────────────────────┐${RESET}"
711
echo -e "${BOLD}${CYAN}│                  before you proceed                         │${RESET}"
712
echo -e "${BOLD}${CYAN}└─────────────────────────────────────────────────────────────┘${RESET}"
713
echo
714
echo -e "  Ensure the following databases exist on ${BOLD}${DB_HOST}:${DB_PORT}${RESET}"
715
echo
716
echo "    psql -h localhost -p $DB_PORT -U $DB_USER -d postgres -c '\l'"
717
echo
718
echo -e "  Expected databases:"
719
echo -e "    ${GREEN}✓${RESET}  $DB_NAME_SCALEKIT    (Scalekit main application)"
720
echo -e "    ${GREEN}✓${RESET}  $DB_NAME_SVIX        (Svix webhooks)"
721
if [[ "$OPENFGA_ENABLED" == "true" ]]; then
722
  echo -e "    ${GREEN}✓${RESET}  $DB_NAME_OPENFGA     (OpenFGA authorization)"
723
fi
724
echo
725
echo -e "  If any database is missing, create it first:"
726
echo "    psql -h localhost -p $DB_PORT -U $DB_USER -d postgres -c 'CREATE DATABASE $DB_NAME_SCALEKIT;'"
727
echo "    psql -h localhost -p $DB_PORT -U $DB_USER -d postgres -c 'CREATE DATABASE $DB_NAME_SVIX;'"
728
if [[ "$OPENFGA_ENABLED" == "true" ]]; then
729
  echo "    psql -h localhost -p $DB_PORT -U $DB_USER -d postgres -c 'CREATE DATABASE $DB_NAME_OPENFGA;'"
730
fi
731
echo
732
echo -e "${BOLD}${CYAN}┌─────────────────────────────────────────────────────────────┐${RESET}"
733
echo -e "${BOLD}${CYAN}│              execute the following commands                  │${RESET}"
734
echo -e "${BOLD}${CYAN}└─────────────────────────────────────────────────────────────┘${RESET}"
735
echo
736
echo "  bash $OUTPUT_FILE"
737
echo
738
echo "  helm install scalekit oci://ar.scalekit.cloud/scalekit/charts/scalekit \\"
739
echo "    --version ${CHART_VERSION} \\"
740
echo "    -n ${NAMESPACE} \\"
741
echo "    --values=${VALUES_FILE}"
742
echo
743
echo -e "${BOLD}${CYAN}└─────────────────────────────────────────────────────────────┘${RESET}"
744

745
if [[ "$ENV_CHOICE" == "1" ]]; then
746
  echo
747
  echo -e "${BOLD}${CYAN}┌─────────────────────────────────────────────────────────────┐${RESET}"
748
  echo -e "${BOLD}${CYAN}│           Minikube — expose & access traffic                 │${RESET}"
749
  echo -e "${BOLD}${CYAN}└─────────────────────────────────────────────────────────────┘${RESET}"
750
  echo
751
  dim "  1. Enable the ingress addon:"
752
  echo "     minikube addons enable ingress"
753
  echo
754
  dim "  2. Patch the ingress controller to type LoadBalancer:"
755
  echo "     kubectl patch svc ingress-nginx-controller \\"
756
  echo "       -n ingress-nginx \\"
757
  echo "       -p '{\"spec\": {\"type\": \"LoadBalancer\"}}'"
758
  echo
759
  dim "  3. Start Minikube tunnel (keep this running in a separate terminal):"
760
  echo "     minikube tunnel"
761
  echo
762
  dim "  4. Add entries to /etc/hosts (requires sudo):"
763
  echo "     sudo sh -c 'echo \"127.0.0.1 app.${APP_DOMAIN} auth.${APP_DOMAIN}\" >> /etc/hosts'"
764
  echo
765
  dim "     Or add manually — open /etc/hosts and append this line:"
766
  echo "     127.0.0.1  app.${APP_DOMAIN}  auth.${APP_DOMAIN}"
767
  echo
768
  dim "  5. Update CoreDNS so pods inside the cluster can resolve app.${APP_DOMAIN} and auth.${APP_DOMAIN}:"
769
  echo
770
  dim "     Open the CoreDNS ConfigMap and find the IP already assigned to host.minikube.internal."
771
  dim "     Add two more entries pointing to that same IP:"
772
  echo
773
  echo "        kubectl edit configmap coredns -n kube-system"
774
  echo
775
  echo "        # Inside the hosts { } block, add:"
776
  echo "        <host.minikube.internal IP>  app.${APP_DOMAIN}"
777
  echo "        <host.minikube.internal IP>  auth.${APP_DOMAIN}"
778
  echo
779
  dim "     Then restart CoreDNS to apply:"
780
  echo "        kubectl rollout restart deployment coredns -n kube-system"
781
  echo
782
  echo "${BOLD}${CYAN}└─────────────────────────────────────────────────────────────┘${RESET}"
783
fi