Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

infrastructure/postgres/init/001-create-databases.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+read_secret() {
+  local name="$1"
+  local path="${POSTGRES_SECRET_ROOT:-/run/secrets}/${name}"
+  [[ -f "$path" && -r "$path" && -s "$path" ]] || {
+    echo "PostgreSQL secret-file validation failed" >&2
+    exit 78
+  }
+  local mode
+  mode="$(stat -c '%a' "$path" 2>/dev/null || true)"
+  [[ "$mode" == "400" || "$mode" == "600" ]] || {
+    echo "PostgreSQL secret-file validation failed" >&2
+    exit 78
+  }
+  [[ "$(stat -c '%u' "$path" 2>/dev/null || true)" == "${POSTGRES_SECRET_EXPECTED_UID:-${SECRET_EXPECTED_UID:?}}" ]] || {
+    echo "PostgreSQL secret-file validation failed" >&2
+    exit 78
+  }
+  [[ "$(stat -c '%g' "$path" 2>/dev/null || true)" == "${POSTGRES_SECRET_EXPECTED_GID:-${SECRET_EXPECTED_GID:?}}" ]] || {
+    echo "PostgreSQL secret-file validation failed" >&2
+    exit 78
+  }
+  local value
+  value="$(tr -d '\r\n' < "$path")"
+  [[ -n "$value" ]] || { echo "PostgreSQL secret-file validation failed" >&2; exit 78; }
+  printf '%s' "$value"
+}
+
+HUB_PASSWORD="$(read_secret hub_database_password)"
+CF_PASSWORD="$(read_secret contextforge_database_password)"
+
+psql --username "$POSTGRES_USER" --dbname postgres --set=ON_ERROR_STOP=1 \
+  --set=hub_password="$HUB_PASSWORD" --set=cf_password="$CF_PASSWORD" <<'SQL'
+SELECT format('CREATE ROLE itworx_mcp_hub LOGIN PASSWORD %L', :'hub_password')
+WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'itworx_mcp_hub')\gexec
+SELECT format('CREATE ROLE contextforge LOGIN PASSWORD %L', :'cf_password')
+WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'contextforge')\gexec
+SELECT 'CREATE DATABASE itworx_mcp_hub OWNER itworx_mcp_hub'
+WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'itworx_mcp_hub')\gexec
+SELECT 'CREATE DATABASE contextforge OWNER contextforge'
+WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'contextforge')\gexec
+REVOKE ALL ON DATABASE itworx_mcp_hub FROM PUBLIC;
+REVOKE ALL ON DATABASE contextforge FROM PUBLIC;
+SQL