51 lines
2.2 KiB
YAML
51 lines
2.2 KiB
YAML
# =============================================================================
|
|
# Database transport security, for the lanes whose runtime requires it.
|
|
#
|
|
# The prod runtime connects with `sslmode=verify-full` and an explicit `sslrootcert`. That is not a
|
|
# lane setting to relax: a prod smoke test against a database with TLS disabled is a smoke test of a
|
|
# configuration production never runs, and the one failure mode it would hide — the certificate
|
|
# chain or the host name not checking out — is the one that only ever appears in production.
|
|
#
|
|
# So the lane brings a real certificate instead. The qualification wrapper generates a CA and a
|
|
# server certificate for the host name `db` per run, at mode 0600, and removes both on teardown; the
|
|
# realm-secret pattern, applied to a keypair. Nothing here is committed: infra/postgres/tls holds
|
|
# only a .gitignore.
|
|
#
|
|
# `verify-full` is deliberate rather than `verify-ca`. `verify-ca` proves the certificate was issued
|
|
# by the expected authority and says nothing about who presented it, so it does not detect a
|
|
# redirected connection — which is most of what transport security is for.
|
|
# =============================================================================
|
|
|
|
services:
|
|
db:
|
|
# Runs as root just long enough to install the key where postgres can read it, then hands over
|
|
# to the official entrypoint. See infra/postgres/entrypoint.sh for why a bind mount cannot do it.
|
|
entrypoint: ["/bin/sh", "/opt/postgres-entrypoint/entrypoint.sh"]
|
|
command:
|
|
- "postgres"
|
|
- "-c"
|
|
- "ssl=on"
|
|
- "-c"
|
|
- "ssl_cert_file=/etc/postgresql-tls/server.crt"
|
|
- "-c"
|
|
- "ssl_key_file=/etc/postgresql-tls/server.key"
|
|
volumes:
|
|
- type: bind
|
|
source: ./infra/postgres/entrypoint.sh
|
|
target: /opt/postgres-entrypoint/entrypoint.sh
|
|
read_only: true
|
|
- type: bind
|
|
source: ./infra/postgres/tls
|
|
target: /opt/postgres-tls
|
|
read_only: true
|
|
|
|
app:
|
|
# The certificate authority the JDBC URL names in `sslrootcert`. A public certificate, so it
|
|
# carries no mode problem — the private half never leaves the database container's filesystem.
|
|
secrets:
|
|
- postgres-ca
|
|
|
|
secrets:
|
|
postgres-ca:
|
|
file: ./infra/postgres/tls/ca.crt
|