From 48ff10277547902151a1149d7534e4cc296b8736 Mon Sep 17 00:00:00 2001 From: javielico Date: Wed, 12 Aug 2026 14:48:15 +0100 Subject: [PATCH] pgsql test init --- .env.sample | 22 +++++++++----- compose.yml | 81 +++++++++++++++++++++++++++++++------------------ init-adm.sh | 21 +++++++++++++ pg_hba.conf | 8 +++++ postgresql.conf | 14 +++++++++ 5 files changed, 109 insertions(+), 37 deletions(-) create mode 100644 init-adm.sh create mode 100644 pg_hba.conf create mode 100644 postgresql.conf diff --git a/.env.sample b/.env.sample index 5cf9799..b0a2bd2 100644 --- a/.env.sample +++ b/.env.sample @@ -1,12 +1,18 @@ TYPE=pgsql - +STACK_NAME=pgsql DOMAIN=pgsql.example.com - -## Domain aliases -#EXTRA_DOMAINS=', `www.pgsql.example.com`' - LETS_ENCRYPT_ENV=production +TZ=UTC -# Secret management -SECRET_PGUSER_VERSION=v1 -SECRET_PGPASSWORD_VERSION=v1 +PG_TCP_ENTRYPOINT=postgres +PG_PORT=5432 # Define port here + +POSTGRES_DB=postgres +PGSSLMODE=require + +SECRET_PG_ROOT_PASSWORD_VERSION=v1 +SECRET_PG_ADM_PASSWORD_VERSION=v1 + +POSTGRESQL_CONF_VERSION=v1 +PG_HBA_CONF_VERSION=v1 +INIT_ADM_VERSION=v1 diff --git a/compose.yml b/compose.yml index 975291f..7c270d8 100644 --- a/compose.yml +++ b/compose.yml @@ -2,39 +2,52 @@ version: "3.8" services: - pgautoupgrade: - image: pgautoupgrade/pgautoupgrade:18-alpine + postgres: + image: postgres:18-alpine networks: - proxy - environment: - PGHOST: postgres - PGPORT: "5432" - PGDATABASE: postgres - PGUSER_FILE: /run/secrets/pguser - PGPASSWORD_FILE: /run/secrets/pgpassword - secrets: - - pguser - - pgpassword volumes: - pgdata:/var/lib/postgresql/data - - pglogs:/var/log/postgresql - + secrets: + - pg_root_password + - pg_adm_password + environment: + TZ: ${TZ:-UTC} + POSTGRES_USER: root + POSTGRES_PASSWORD_FILE: /run/secrets/pg_root_password + POSTGRES_DB: ${POSTGRES_DB:-postgres} + ADM_USERNAME: adm + ADM_PASSWORD_FILE: /run/secrets/pg_adm_password + PGSSLMODE: ${PGSSLMODE:-require} + configs: + - source: postgresql_conf + target: /etc/postgresql/postgresql.conf + mode: 0644 + - source: pg_hba_conf + target: /etc/postgresql/pg_hba.conf + mode: 0644 + - source: init_adm + target: /docker-entrypoint-initdb.d/001-init-adm.sh + mode: 0555 + healthcheck: + test: ["CMD-SHELL", "pg_isready -U root -d ${POSTGRES_DB:-postgres}"] + interval: 10s + timeout: 5s + retries: 10 + start_period: 30s deploy: restart_policy: condition: on-failure labels: + - "traefik.enable=true" + - "traefik.docker.network=proxy" + - "traefik.tcp.routers.${STACK_NAME}.entrypoints=${PG_TCP_ENTRYPOINT}" + - "traefik.tcp.routers.${STACK_NAME}.rule=HostSNI(`*`)" + - "traefik.tcp.routers.${STACK_NAME}.service=${STACK_NAME}" + - "traefik.tcp.services.${STACK_NAME}.loadbalancer.server.port=${PG_PORT}" - "backupbot.backup=true" - - "backupbot.backup.path=/var/lib/postgresql/data/,/var/log/postgresql/" - - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-240}" - - "coop-cloud.${STACK_NAME}.version=18-alpine" - - "traefik.enable=false" - - healthcheck: - test: ["CMD-SHELL", "ps -ef | grep -v grep | grep -qi pgautoupgrade || exit 1"] - interval: 30s - timeout: 10s - retries: 10 - start_period: 30s + - "backupbot.backup.path=/var/lib/postgresql/data/" + - "coop-cloud.${STACK_NAME}.app.version=postgres:18-alpine" networks: proxy: @@ -42,12 +55,22 @@ networks: volumes: pgdata: - pglogs: secrets: - pguser: + pg_root_password: external: true - name: ${STACK_NAME}_pguser_${SECRET_PGUSER_VERSION} - pgpassword: + name: ${STACK_NAME}_pg_root_password_${SECRET_PG_ROOT_PASSWORD_VERSION} + pg_adm_password: external: true - name: ${STACK_NAME}_pgpassword_${SECRET_PGPASSWORD_VERSION} + name: ${STACK_NAME}_pg_adm_password_${SECRET_PG_ADM_PASSWORD_VERSION} + +configs: + postgresql_conf: + name: ${STACK_NAME}_postgresql_conf_${POSTGRESQL_CONF_VERSION:-v1} + file: postgresql.conf + pg_hba_conf: + name: ${STACK_NAME}_pg_hba_conf_${PG_HBA_CONF_VERSION:-v1} + file: pg_hba.conf + init_adm: + name: ${STACK_NAME}_init_adm_${INIT_ADM_VERSION:-v1} + file: init-adm.sh diff --git a/init-adm.sh b/init-adm.sh new file mode 100644 index 0000000..be4771b --- /dev/null +++ b/init-adm.sh @@ -0,0 +1,21 @@ +#!/bin/sh +set -eu + +ADM_USERNAME="${ADM_USERNAME:-adm}" +ADM_PASSWORD_FILE="${ADM_PASSWORD_FILE:-/run/secrets/pg_adm_password}" + +POSTGRES_USER="${POSTGRES_USER:?POSTGRES_USER required}" +POSTGRES_DB="${POSTGRES_DB:-postgres}" + +ADM_PASSWORD="$(cat "$ADM_PASSWORD_FILE")" + +psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \ + -v u="$ADM_USERNAME" -v p="$ADM_PASSWORD" <<'SQL' +DO $$ +BEGIN + IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = :'u') THEN + EXECUTE format('CREATE ROLE %I LOGIN PASSWORD %L', :'u', :'p'); + END IF; +END +$$; +SQL diff --git a/pg_hba.conf b/pg_hba.conf new file mode 100644 index 0000000..9188805 --- /dev/null +++ b/pg_hba.conf @@ -0,0 +1,8 @@ +local all root scram-sha-256 +local all adm scram-sha-256 +host all root 0.0.0.0/0 reject +host all adm 0.0.0.0/0 reject +host all all 0.0.0.0/0 reject +host all root ::/0 reject +host all adm ::/0 reject +host all all ::/0 reject diff --git a/postgresql.conf b/postgresql.conf new file mode 100644 index 0000000..7a05cb9 --- /dev/null +++ b/postgresql.conf @@ -0,0 +1,14 @@ +listen_addresses = '*' +port = 5432 +password_encryption = scram-sha-256 +ssl = on +ssl_min_protocol_version = 'TLSv1.2' +hba_file = '/etc/postgresql/pg_hba.conf' +config_file = '/etc/postgresql/postgresql.conf' +log_connections = on +log_disconnections = on +log_min_messages = warning +log_statement = 'none' +shared_buffers = 256MB +max_connections = 100 +track_activity_query_size = 1024