Use dedicated net-alerter Matrix service account, keep credentials out of repo

.gitignore

@@ -9,3 +9,4 @@ __pycache__/
 *.pcap
 *.pcap.zst
 *.pcap.zst.enc
+net_alerter/.secrets

net_alerter/deploy.sh

@@ -8,15 +8,22 @@ SSH_ALIAS="condo"
 REMOTE_DIR="/opt/net_alerter"
 SCRIPT="$(dirname "$0")/net_alerter.py"
 
-# Matrix access token — get fresh one if not passed
+# Matrix access token for net-alerter service account
+# Get fresh token if not passed — credentials stored in secrets file
+SECRETS_FILE="$(dirname "$0")/.secrets"
 if [[ -n "${1:-}" ]]; then
   TOKEN="$1"
-else
-  echo "[*] Fetching Matrix access token..."
+elif [[ -f "$SECRETS_FILE" ]]; then
+  # shellcheck source=/dev/null
+  source "$SECRETS_FILE"
+  echo "[*] Fetching Matrix access token for net-alerter..."
   TOKEN=$(curl -s -X POST https://m.example.org/_matrix/client/v3/login \
     -H "Content-Type: application/json" \
-    -d '{"type":"m.login.password","identifier":{"type":"m.id.user","user":"spectre"},"password":"spectre-cfe6b5f9dd10dd31a204e4a7"}' \
+    -d "{\"type\":\"m.login.password\",\"identifier\":{\"type\":\"m.id.user\",\"user\":\"net-alerter\"},\"password\":\"${NET_ALERTER_MATRIX_PASS}\"}" \
     | python3 -c "import sys,json; print(json.load(sys.stdin)['access_token'])")
+else
+  echo "[error] Pass a token as \$1 or create $(dirname "$0")/.secrets with NET_ALERTER_MATRIX_PASS=..."
+  exit 1
 fi
 
 echo "[*] Deploying to $SSH_ALIAS..."