37 lines
1.3 KiB
Bash
37 lines
1.3 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
fail_secret() {
|
|
echo "PostgreSQL secret-file validation failed" >&2
|
|
exit 78
|
|
}
|
|
|
|
source_root=/run/secrets
|
|
runtime_root=/run/itworx-secrets
|
|
runtime_uid="$(id -u postgres)"
|
|
runtime_gid="$(id -g postgres)"
|
|
|
|
install -d -o root -g "$runtime_gid" -m 0750 "$runtime_root"
|
|
|
|
for name in postgres_superuser_password hub_database_password contextforge_database_password; do
|
|
source="$source_root/$name"
|
|
target="$runtime_root/$name"
|
|
[ -f "$source" ] && [ ! -L "$source" ] && [ -r "$source" ] && [ -s "$source" ] || fail_secret
|
|
mode="$(stat -c '%a' "$source" 2>/dev/null || true)"
|
|
case "$mode" in 400|600) ;; *) fail_secret ;; esac
|
|
[ "$(stat -c '%u' "$source" 2>/dev/null || true)" = "${SECRET_EXPECTED_UID:?}" ] || fail_secret
|
|
[ "$(stat -c '%g' "$source" 2>/dev/null || true)" = "${SECRET_EXPECTED_GID:?}" ] || fail_secret
|
|
[ "$(wc -c < "$source")" -le 8192 ] || fail_secret
|
|
value="$(tr -d '\r\n' < "$source")"
|
|
[ -n "$value" ] || fail_secret
|
|
unset value
|
|
install -o "$runtime_uid" -g "$runtime_gid" -m 0400 "$source" "$target"
|
|
done
|
|
|
|
export POSTGRES_PASSWORD_FILE="$runtime_root/postgres_superuser_password"
|
|
export POSTGRES_SECRET_ROOT="$runtime_root"
|
|
export POSTGRES_SECRET_EXPECTED_UID="$runtime_uid"
|
|
export POSTGRES_SECRET_EXPECTED_GID="$runtime_gid"
|
|
|
|
exec /usr/local/bin/docker-entrypoint.sh "$@"
|