mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 18:44:33 +00:00
60 lines
1.7 KiB
Bash
60 lines
1.7 KiB
Bash
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
|
|
: "${OPENBAO_ADDR:?OPENBAO_ADDR is required (e.g. https://openbao.example.com:8200)}"
|
|
: "${OPENBAO_MOUNT:?OPENBAO_MOUNT is required (e.g. secret/data)}"
|
|
|
|
PROVIDER="${PG_TDE_PROVIDER_NAME:-openbao}"
|
|
DEFAULT_KEY="${PG_TDE_PRINCIPAL_KEY_NAME:-knoe-default-key}"
|
|
|
|
TOKEN_FILE="${OPENBAO_TOKEN_FILE:-/run/secrets/openbao_token}"
|
|
|
|
if [[ ! -f "$TOKEN_FILE" ]]; then
|
|
echo "ERROR: OpenBao token file not found at $TOKEN_FILE (mount it read-only)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
CA_FILE="${OPENBAO_CA_CERT_FILE:-}"
|
|
CA_SQL="NULL"
|
|
if [[ -n "$CA_FILE" ]]; then
|
|
[[ -f "$CA_FILE" ]] || { echo "ERROR: CA file not found: $CA_FILE" >&2; exit 1; }
|
|
CA_SQL="'$CA_FILE'"
|
|
fi
|
|
|
|
# Note: pg_tde must be preloaded. Use ENABLE_PG_TDE=1 so the wrapper injects it.
|
|
psql -v ON_ERROR_STOP=1 --username "${POSTGRES_USER:-postgres}" --dbname "${POSTGRES_DB:-postgres}" <<SQL
|
|
CREATE SCHEMA IF NOT EXISTS knoe;
|
|
DO $$
|
|
BEGIN
|
|
IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'knoe') THEN
|
|
ALTER SCHEMA knoe OWNER TO knoe;
|
|
END IF;
|
|
END
|
|
$$;
|
|
|
|
CREATE EXTENSION IF NOT EXISTS pg_tde SCHEMA knoe;
|
|
DO $$
|
|
BEGIN
|
|
IF EXISTS (
|
|
SELECT 1
|
|
FROM pg_extension e
|
|
JOIN pg_namespace n ON n.oid = e.extnamespace
|
|
WHERE e.extname = 'pg_tde' AND n.nspname <> 'knoe'
|
|
) THEN
|
|
ALTER EXTENSION pg_tde SET SCHEMA knoe;
|
|
END IF;
|
|
END
|
|
$$;
|
|
# CREATE EXTENSION IF NOT EXISTS pg_knoelog;
|
|
|
|
SELECT pg_tde_add_global_key_provider_vault_v2(
|
|
'${PROVIDER}',
|
|
'${OPENBAO_ADDR}',
|
|
'${OPENBAO_MOUNT}',
|
|
'${TOKEN_FILE}',
|
|
${CA_SQL}
|
|
);
|
|
|
|
SELECT pg_tde_create_key_using_global_key_provider('${DEFAULT_KEY}', '${PROVIDER}');
|
|
SELECT pg_tde_set_default_key_using_global_key_provider('${DEFAULT_KEY}', '${PROVIDER}');
|
|
SQL |