38 lines
1.8 KiB
Bash
Executable File
38 lines
1.8 KiB
Bash
Executable File
#!/bin/sh
|
|
# =============================================================================
|
|
# Installs the server certificate where PostgreSQL will accept it, then hands over.
|
|
#
|
|
# PostgreSQL refuses to start if the private key is group- or world-readable, and it reads the key
|
|
# as the `postgres` user — uid 70 in the Alpine image. The certificate is generated on the host by
|
|
# the qualification wrapper, so it arrives owned by whoever ran the script; a bind mount preserves
|
|
# that ownership, and the two facts together mean a mounted key is either unreadable by postgres or
|
|
# too permissive for it. Neither is fixable from the outside.
|
|
#
|
|
# So the key is copied, once, at the only moment this container is still root: before the official
|
|
# entrypoint gosu's down to postgres. The copy lives on the container filesystem, not on the mount,
|
|
# and the mount stays read-only.
|
|
#
|
|
# The same problem, the same shape as the Keycloak client secret and the MinIO smoke client. It is
|
|
# worth stating plainly: bind-mounted credentials and per-image uids do not compose, and every
|
|
# service that needs one has to say how it bridges them.
|
|
# =============================================================================
|
|
set -eu
|
|
|
|
TLS_SOURCE="${POSTGRES_TLS_DIR:-/opt/postgres-tls}"
|
|
TLS_TARGET=/etc/postgresql-tls
|
|
|
|
if [ -f "${TLS_SOURCE}/server.key" ] && [ -f "${TLS_SOURCE}/server.crt" ]; then
|
|
mkdir -p "${TLS_TARGET}"
|
|
cp "${TLS_SOURCE}/server.key" "${TLS_TARGET}/server.key"
|
|
cp "${TLS_SOURCE}/server.crt" "${TLS_TARGET}/server.crt"
|
|
chown -R postgres:postgres "${TLS_TARGET}"
|
|
chmod 0700 "${TLS_TARGET}"
|
|
chmod 0600 "${TLS_TARGET}/server.key"
|
|
chmod 0644 "${TLS_TARGET}/server.crt"
|
|
else
|
|
echo "postgres-entrypoint: no certificate at ${TLS_SOURCE}; refusing to start a TLS lane without one" >&2
|
|
exit 1
|
|
fi
|
|
|
|
exec docker-entrypoint.sh "$@"
|