pgsql test init
This commit is contained in:
+14
-8
@@ -1,12 +1,18 @@
|
||||
TYPE=pgsql
|
||||
|
||||
STACK_NAME=pgsql
|
||||
DOMAIN=pgsql.example.com
|
||||
|
||||
## Domain aliases
|
||||
#EXTRA_DOMAINS=', `www.pgsql.example.com`'
|
||||
|
||||
LETS_ENCRYPT_ENV=production
|
||||
TZ=UTC
|
||||
|
||||
# Secret management
|
||||
SECRET_PGUSER_VERSION=v1
|
||||
SECRET_PGPASSWORD_VERSION=v1
|
||||
PG_TCP_ENTRYPOINT=postgres
|
||||
PG_PORT=5432 # Define port here
|
||||
|
||||
POSTGRES_DB=postgres
|
||||
PGSSLMODE=require
|
||||
|
||||
SECRET_PG_ROOT_PASSWORD_VERSION=v1
|
||||
SECRET_PG_ADM_PASSWORD_VERSION=v1
|
||||
|
||||
POSTGRESQL_CONF_VERSION=v1
|
||||
PG_HBA_CONF_VERSION=v1
|
||||
INIT_ADM_VERSION=v1
|
||||
|
||||
+52
-29
@@ -2,39 +2,52 @@
|
||||
version: "3.8"
|
||||
|
||||
services:
|
||||
pgautoupgrade:
|
||||
image: pgautoupgrade/pgautoupgrade:18-alpine
|
||||
postgres:
|
||||
image: postgres:18-alpine
|
||||
networks:
|
||||
- proxy
|
||||
environment:
|
||||
PGHOST: postgres
|
||||
PGPORT: "5432"
|
||||
PGDATABASE: postgres
|
||||
PGUSER_FILE: /run/secrets/pguser
|
||||
PGPASSWORD_FILE: /run/secrets/pgpassword
|
||||
secrets:
|
||||
- pguser
|
||||
- pgpassword
|
||||
volumes:
|
||||
- pgdata:/var/lib/postgresql/data
|
||||
- pglogs:/var/log/postgresql
|
||||
|
||||
secrets:
|
||||
- pg_root_password
|
||||
- pg_adm_password
|
||||
environment:
|
||||
TZ: ${TZ:-UTC}
|
||||
POSTGRES_USER: root
|
||||
POSTGRES_PASSWORD_FILE: /run/secrets/pg_root_password
|
||||
POSTGRES_DB: ${POSTGRES_DB:-postgres}
|
||||
ADM_USERNAME: adm
|
||||
ADM_PASSWORD_FILE: /run/secrets/pg_adm_password
|
||||
PGSSLMODE: ${PGSSLMODE:-require}
|
||||
configs:
|
||||
- source: postgresql_conf
|
||||
target: /etc/postgresql/postgresql.conf
|
||||
mode: 0644
|
||||
- source: pg_hba_conf
|
||||
target: /etc/postgresql/pg_hba.conf
|
||||
mode: 0644
|
||||
- source: init_adm
|
||||
target: /docker-entrypoint-initdb.d/001-init-adm.sh
|
||||
mode: 0555
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U root -d ${POSTGRES_DB:-postgres}"]
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 10
|
||||
start_period: 30s
|
||||
deploy:
|
||||
restart_policy:
|
||||
condition: on-failure
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=proxy"
|
||||
- "traefik.tcp.routers.${STACK_NAME}.entrypoints=${PG_TCP_ENTRYPOINT}"
|
||||
- "traefik.tcp.routers.${STACK_NAME}.rule=HostSNI(`*`)"
|
||||
- "traefik.tcp.routers.${STACK_NAME}.service=${STACK_NAME}"
|
||||
- "traefik.tcp.services.${STACK_NAME}.loadbalancer.server.port=${PG_PORT}"
|
||||
- "backupbot.backup=true"
|
||||
- "backupbot.backup.path=/var/lib/postgresql/data/,/var/log/postgresql/"
|
||||
- "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-240}"
|
||||
- "coop-cloud.${STACK_NAME}.version=18-alpine"
|
||||
- "traefik.enable=false"
|
||||
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "ps -ef | grep -v grep | grep -qi pgautoupgrade || exit 1"]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 10
|
||||
start_period: 30s
|
||||
- "backupbot.backup.path=/var/lib/postgresql/data/"
|
||||
- "coop-cloud.${STACK_NAME}.app.version=postgres:18-alpine"
|
||||
|
||||
networks:
|
||||
proxy:
|
||||
@@ -42,12 +55,22 @@ networks:
|
||||
|
||||
volumes:
|
||||
pgdata:
|
||||
pglogs:
|
||||
|
||||
secrets:
|
||||
pguser:
|
||||
pg_root_password:
|
||||
external: true
|
||||
name: ${STACK_NAME}_pguser_${SECRET_PGUSER_VERSION}
|
||||
pgpassword:
|
||||
name: ${STACK_NAME}_pg_root_password_${SECRET_PG_ROOT_PASSWORD_VERSION}
|
||||
pg_adm_password:
|
||||
external: true
|
||||
name: ${STACK_NAME}_pgpassword_${SECRET_PGPASSWORD_VERSION}
|
||||
name: ${STACK_NAME}_pg_adm_password_${SECRET_PG_ADM_PASSWORD_VERSION}
|
||||
|
||||
configs:
|
||||
postgresql_conf:
|
||||
name: ${STACK_NAME}_postgresql_conf_${POSTGRESQL_CONF_VERSION:-v1}
|
||||
file: postgresql.conf
|
||||
pg_hba_conf:
|
||||
name: ${STACK_NAME}_pg_hba_conf_${PG_HBA_CONF_VERSION:-v1}
|
||||
file: pg_hba.conf
|
||||
init_adm:
|
||||
name: ${STACK_NAME}_init_adm_${INIT_ADM_VERSION:-v1}
|
||||
file: init-adm.sh
|
||||
|
||||
+21
@@ -0,0 +1,21 @@
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
|
||||
ADM_USERNAME="${ADM_USERNAME:-adm}"
|
||||
ADM_PASSWORD_FILE="${ADM_PASSWORD_FILE:-/run/secrets/pg_adm_password}"
|
||||
|
||||
POSTGRES_USER="${POSTGRES_USER:?POSTGRES_USER required}"
|
||||
POSTGRES_DB="${POSTGRES_DB:-postgres}"
|
||||
|
||||
ADM_PASSWORD="$(cat "$ADM_PASSWORD_FILE")"
|
||||
|
||||
psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
|
||||
-v u="$ADM_USERNAME" -v p="$ADM_PASSWORD" <<'SQL'
|
||||
DO $$
|
||||
BEGIN
|
||||
IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = :'u') THEN
|
||||
EXECUTE format('CREATE ROLE %I LOGIN PASSWORD %L', :'u', :'p');
|
||||
END IF;
|
||||
END
|
||||
$$;
|
||||
SQL
|
||||
@@ -0,0 +1,8 @@
|
||||
local all root scram-sha-256
|
||||
local all adm scram-sha-256
|
||||
host all root 0.0.0.0/0 reject
|
||||
host all adm 0.0.0.0/0 reject
|
||||
host all all 0.0.0.0/0 reject
|
||||
host all root ::/0 reject
|
||||
host all adm ::/0 reject
|
||||
host all all ::/0 reject
|
||||
@@ -0,0 +1,14 @@
|
||||
listen_addresses = '*'
|
||||
port = 5432
|
||||
password_encryption = scram-sha-256
|
||||
ssl = on
|
||||
ssl_min_protocol_version = 'TLSv1.2'
|
||||
hba_file = '/etc/postgresql/pg_hba.conf'
|
||||
config_file = '/etc/postgresql/postgresql.conf'
|
||||
log_connections = on
|
||||
log_disconnections = on
|
||||
log_min_messages = warning
|
||||
log_statement = 'none'
|
||||
shared_buffers = 256MB
|
||||
max_connections = 100
|
||||
track_activity_query_size = 1024
|
||||
Reference in New Issue
Block a user