47 lines
1.9 KiB
Bash
47 lines
1.9 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
read_secret() {
|
|
local name="$1"
|
|
local path="${POSTGRES_SECRET_ROOT:-/run/secrets}/${name}"
|
|
[[ -f "$path" && -r "$path" && -s "$path" ]] || {
|
|
echo "PostgreSQL secret-file validation failed" >&2
|
|
exit 78
|
|
}
|
|
local mode
|
|
mode="$(stat -c '%a' "$path" 2>/dev/null || true)"
|
|
[[ "$mode" == "400" || "$mode" == "600" ]] || {
|
|
echo "PostgreSQL secret-file validation failed" >&2
|
|
exit 78
|
|
}
|
|
[[ "$(stat -c '%u' "$path" 2>/dev/null || true)" == "${POSTGRES_SECRET_EXPECTED_UID:-${SECRET_EXPECTED_UID:?}}" ]] || {
|
|
echo "PostgreSQL secret-file validation failed" >&2
|
|
exit 78
|
|
}
|
|
[[ "$(stat -c '%g' "$path" 2>/dev/null || true)" == "${POSTGRES_SECRET_EXPECTED_GID:-${SECRET_EXPECTED_GID:?}}" ]] || {
|
|
echo "PostgreSQL secret-file validation failed" >&2
|
|
exit 78
|
|
}
|
|
local value
|
|
value="$(tr -d '\r\n' < "$path")"
|
|
[[ -n "$value" ]] || { echo "PostgreSQL secret-file validation failed" >&2; exit 78; }
|
|
printf '%s' "$value"
|
|
}
|
|
|
|
HUB_PASSWORD="$(read_secret hub_database_password)"
|
|
CF_PASSWORD="$(read_secret contextforge_database_password)"
|
|
|
|
psql --username "$POSTGRES_USER" --dbname postgres --set=ON_ERROR_STOP=1 \
|
|
--set=hub_password="$HUB_PASSWORD" --set=cf_password="$CF_PASSWORD" <<'SQL'
|
|
SELECT format('CREATE ROLE itworx_mcp_hub LOGIN PASSWORD %L', :'hub_password')
|
|
WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'itworx_mcp_hub')\gexec
|
|
SELECT format('CREATE ROLE contextforge LOGIN PASSWORD %L', :'cf_password')
|
|
WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'contextforge')\gexec
|
|
SELECT 'CREATE DATABASE itworx_mcp_hub OWNER itworx_mcp_hub'
|
|
WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'itworx_mcp_hub')\gexec
|
|
SELECT 'CREATE DATABASE contextforge OWNER contextforge'
|
|
WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'contextforge')\gexec
|
|
REVOKE ALL ON DATABASE itworx_mcp_hub FROM PUBLIC;
|
|
REVOKE ALL ON DATABASE contextforge FROM PUBLIC;
|
|
SQL
|