#!/usr/bin/env bash
# Export BOOTSTRAP_SU_PASSWORD from vault_lxc_root_password
set -euo pipefail
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
eval "$("${REPO_ROOT}/.venv/bin/python3" - "${REPO_ROOT}" <<'PY'
import os, subprocess, sys, yaml, shlex
repo = sys.argv[1]
text = subprocess.check_output(
    [os.path.join(repo, ".venv/bin/ansible-vault"), "view",
     os.path.join(repo, "inventories/production/group_vars/all/vault.yml"),
     "--vault-password-file", os.path.expanduser("~/.ansible-vault-pass")],
    text=True,
)
pw = (yaml.safe_load(text) or {}).get("vault_lxc_root_password", "")
if pw:
    print("export BOOTSTRAP_SU_PASSWORD=" + shlex.quote(str(pw)))
PY
)"