Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

infrastructure/images/postgres/entrypoint.sh

@@ -0,0 +1,36 @@
+#!/bin/sh
+set -eu
+
+fail_secret() {
+  echo "PostgreSQL secret-file validation failed" >&2
+  exit 78
+}
+
+source_root=/run/secrets
+runtime_root=/run/itworx-secrets
+runtime_uid="$(id -u postgres)"
+runtime_gid="$(id -g postgres)"
+
+install -d -o root -g "$runtime_gid" -m 0750 "$runtime_root"
+
+for name in postgres_superuser_password hub_database_password contextforge_database_password; do
+  source="$source_root/$name"
+  target="$runtime_root/$name"
+  [ -f "$source" ] && [ ! -L "$source" ] && [ -r "$source" ] && [ -s "$source" ] || fail_secret
+  mode="$(stat -c '%a' "$source" 2>/dev/null || true)"
+  case "$mode" in 400|600) ;; *) fail_secret ;; esac
+  [ "$(stat -c '%u' "$source" 2>/dev/null || true)" = "${SECRET_EXPECTED_UID:?}" ] || fail_secret
+  [ "$(stat -c '%g' "$source" 2>/dev/null || true)" = "${SECRET_EXPECTED_GID:?}" ] || fail_secret
+  [ "$(wc -c < "$source")" -le 8192 ] || fail_secret
+  value="$(tr -d '\r\n' < "$source")"
+  [ -n "$value" ] || fail_secret
+  unset value
+  install -o "$runtime_uid" -g "$runtime_gid" -m 0400 "$source" "$target"
+done
+
+export POSTGRES_PASSWORD_FILE="$runtime_root/postgres_superuser_password"
+export POSTGRES_SECRET_ROOT="$runtime_root"
+export POSTGRES_SECRET_EXPECTED_UID="$runtime_uid"
+export POSTGRES_SECRET_EXPECTED_GID="$runtime_gid"
+
+exec /usr/local/bin/docker-entrypoint.sh "$@"