tftsr_ai/templates/vault/vault-unseal.sh.j2

#!/bin/bash
# Vault auto-unseal script
# Reads unseal key from vault-init.json and unseals Vault

set -e

VAULT_ADDR="http://127.0.0.1:8200"
INIT_FILE="/docker_mounts/vault/vault-init.json"

if [ ! -f "$INIT_FILE" ]; then
    echo "ERROR: vault-init.json not found at $INIT_FILE"
    exit 1
fi

UNSEAL_KEY=$(jq -r '.unseal_keys_b64[0]' "$INIT_FILE")

if [ -z "$UNSEAL_KEY" ]; then
    echo "ERROR: Could not extract unseal key from $INIT_FILE"
    exit 1
fi

# Wait for Vault to be ready
for i in $(seq 1 30); do
    STATUS=$(curl -sf "${VAULT_ADDR}/v1/sys/health" 2>/dev/null || true)
    if [ -n "$STATUS" ]; then
        SEALED=$(echo "$STATUS" | jq -r '.sealed')
        if [ "$SEALED" = "false" ]; then
            echo "Vault is already unsealed."
            exit 0
        fi
        break
    fi
    echo "Waiting for Vault... ($i/30)"
    sleep 2
done

echo "Unsealing Vault..."
curl -sf -X PUT "${VAULT_ADDR}/v1/sys/unseal" \
    -H "Content-Type: application/json" \
    -d "{\"key\": \"${UNSEAL_KEY}\"}"

echo "Vault unsealed successfully."