From 2a5ad9825060a78fb33e56786d621fa6321a9f87 Mon Sep 17 00:00:00 2001
From: Michael McGary <michael@waterschurch.org>
Date: Wed, 14 Oct 2026 14:33:48 -0400
Subject: [PATCH] Add set-google-client-id.sh for the AWS box

Prompts for the OAuth client ID, writes it to /opt/waters-boards/.env,
recreates the app container and prints the sign-in config it reports.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 README.md                          |  4 +++
 deploy/aws/set-google-client-id.sh | 46 ++++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+)
 create mode 100755 deploy/aws/set-google-client-id.sh

diff --git a/README.md b/README.md
index 611ec81..598e8f4 100644
--- a/README.md
+++ b/README.md
@@ -61,6 +61,9 @@ Google only allows sign-in from **https** addresses (or `localhost`), so the app
    - Authorized JavaScript origins: `https://boards.watersmedia.org` (and `http://localhost:3100` for local testing)
    - No redirect URIs are needed.
 5. Copy the **Client ID** (ends in `.apps.googleusercontent.com`) into `GOOGLE_CLIENT_ID` in `.env`.
+   On the AWS box, `deploy/aws/set-google-client-id.sh` does that for you: it prompts for the ID,
+   writes it to `/opt/waters-boards/.env`, recreates the app container and prints the sign-in
+   config the server reports afterwards.
 
 The server checks every Google sign-in itself. It rejects any account outside
 `ALLOWED_DOMAINS` and any email Google hasn't verified.
@@ -224,4 +227,5 @@ deploy/aws/
   docker-compose.yml   The app and Caddy containers, as run on the Lightsail box
   Caddyfile            Caddy config: HTTPS for boards.watersmedia.org, proxy to the app
   deploy.sh            Deploys from a laptop or Gitea: check, copy, rebuild, wait for healthy
+  set-google-client-id.sh   Writes GOOGLE_CLIENT_ID to the box's .env and recreates the app
 ```
diff --git a/deploy/aws/set-google-client-id.sh b/deploy/aws/set-google-client-id.sh
new file mode 100755
index 0000000..a1fb06d
--- /dev/null
+++ b/deploy/aws/set-google-client-id.sh
@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# Put the Google OAuth client ID into the box's .env and recreate the app container.
+#
+# Usage, from the repo root:
+#   deploy/aws/set-google-client-id.sh                 # prompts for the ID
+#   deploy/aws/set-google-client-id.sh <client-id>
+#
+# Target host comes from BOARDS_HOST (default: the "boards-aws" SSH alias). Only the
+# GOOGLE_CLIENT_ID line in /opt/waters-boards/.env is changed. A container restart is not
+# enough for an env_file change, so the app container is recreated (data/ is untouched).
+
+set -euo pipefail
+
+HOST="${BOARDS_HOST:-boards-aws}"
+REMOTE_DIR=/opt/waters-boards
+SSH=(ssh -o BatchMode=yes "$HOST")
+
+ID="${1:-}"
+if [ -z "$ID" ]; then
+  printf 'Paste the Google OAuth client ID (ends in .apps.googleusercontent.com): '
+  read -r ID
+fi
+ID="${ID//[[:space:]]/}"
+case "$ID" in
+  *.apps.googleusercontent.com) ;;
+  *) echo "That doesn't look like a Google client ID: '$ID'" >&2; exit 1 ;;
+esac
+
+echo "==> Writing GOOGLE_CLIENT_ID to $HOST:$REMOTE_DIR/.env"
+"${SSH[@]}" "sed -i 's|^GOOGLE_CLIENT_ID=.*|GOOGLE_CLIENT_ID=$ID|' $REMOTE_DIR/.env && grep -q '^GOOGLE_CLIENT_ID=$ID\$' $REMOTE_DIR/.env" \
+  || { echo "ABORT: could not set GOOGLE_CLIENT_ID in $REMOTE_DIR/.env (is the line present?)" >&2; exit 1; }
+
+echo "==> Recreating the app container so it reads the new .env"
+"${SSH[@]}" "cd $REMOTE_DIR && docker compose up -d boards"
+
+echo "==> Waiting for it to report healthy"
+for i in $(seq 1 20); do
+  s=$("${SSH[@]}" "docker inspect --format '{{.State.Health.Status}}' waters-boards" 2>/dev/null || echo starting)
+  [ "$s" = healthy ] && break
+  sleep 3
+done
+echo "    $s"
+
+echo "==> Sign-in config the server now reports (googleClientId should be set):"
+"${SSH[@]}" "docker exec waters-boards wget -qO- http://127.0.0.1:3100/api/auth/config"
+echo