Harden lease lifecycle durability

cmd/orchestra-password/main.go

@@ -0,0 +1,27 @@
+// orchestra-password prints a bcrypt hash suitable for ORCHESTRA_WEB_PASSWORD_HASH.
+package main
+
+import (
+	"fmt"
+	"os"
+	"syscall"
+
+	"golang.org/x/crypto/bcrypt"
+	"golang.org/x/term"
+)
+
+func main() {
+	fmt.Fprint(os.Stderr, "Password: ")
+	password, err := term.ReadPassword(int(syscall.Stdin))
+	fmt.Fprintln(os.Stderr)
+	if err != nil || len(password) == 0 {
+		fmt.Fprintln(os.Stderr, "password is required")
+		os.Exit(1)
+	}
+	hash, err := bcrypt.GenerateFromPassword(password, bcrypt.DefaultCost)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "hash password:", err)
+		os.Exit(1)
+	}
+	fmt.Println(string(hash))
+}