mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 19:54:32 +00:00
39 lines
1.2 KiB
Bash
39 lines
1.2 KiB
Bash
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
|
|
: "${OPENBAO_ADDR:?OPENBAO_ADDR is required (e.g. https://openbao.example.com:8200)}"
|
|
: "${OPENBAO_MOUNT:?OPENBAO_MOUNT is required (e.g. secret/data)}"
|
|
|
|
PROVIDER="${PG_TDE_PROVIDER_NAME:-openbao}"
|
|
DEFAULT_KEY="${PG_TDE_PRINCIPAL_KEY_NAME:-prole-default-key}"
|
|
|
|
TOKEN_FILE="${OPENBAO_TOKEN_FILE:-/run/secrets/openbao_token}"
|
|
|
|
if [[ ! -f "$TOKEN_FILE" ]]; then
|
|
echo "ERROR: OpenBao token file not found at $TOKEN_FILE (mount it read-only)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
CA_FILE="${OPENBAO_CA_CERT_FILE:-}"
|
|
CA_SQL="NULL"
|
|
if [[ -n "$CA_FILE" ]]; then
|
|
[[ -f "$CA_FILE" ]] || { echo "ERROR: CA file not found: $CA_FILE" >&2; exit 1; }
|
|
CA_SQL="'$CA_FILE'"
|
|
fi
|
|
|
|
# Note: pg_tde must be preloaded. Use ENABLE_PG_TDE=1 so the wrapper injects it.
|
|
psql -v ON_ERROR_STOP=1 --username "${POSTGRES_USER:-postgres}" --dbname "${POSTGRES_DB:-postgres}" <<SQL
|
|
CREATE EXTENSION IF NOT EXISTS pg_tde;
|
|
CREATE EXTENSION IF NOT EXISTS pg_prolelog;
|
|
|
|
SELECT pg_tde_add_global_key_provider_vault_v2(
|
|
'${PROVIDER}',
|
|
'${OPENBAO_ADDR}',
|
|
'${OPENBAO_MOUNT}',
|
|
'${TOKEN_FILE}',
|
|
${CA_SQL}
|
|
);
|
|
|
|
SELECT pg_tde_create_key_using_global_key_provider('${DEFAULT_KEY}', '${PROVIDER}');
|
|
SELECT pg_tde_set_default_key_using_global_key_provider('${DEFAULT_KEY}', '${PROVIDER}');
|
|
SQL |