prole/knoe-db/10_pg_tde_openbao.sh

#!/usr/bin/env bash
set -Eeuo pipefail

: "${OPENBAO_ADDR:?OPENBAO_ADDR is required (e.g. https://openbao.example.com:8200)}"
: "${OPENBAO_MOUNT:?OPENBAO_MOUNT is required (e.g. secret/data)}"

PROVIDER="${PG_TDE_PROVIDER_NAME:-openbao}"
DEFAULT_KEY="${PG_TDE_PRINCIPAL_KEY_NAME:-prole-default-key}"

TOKEN_FILE="${OPENBAO_TOKEN_FILE:-/run/secrets/openbao_token}"

if [[ ! -f "$TOKEN_FILE" ]]; then
  echo "ERROR: OpenBao token file not found at $TOKEN_FILE (mount it read-only)" >&2
  exit 1
fi

CA_FILE="${OPENBAO_CA_CERT_FILE:-}"
CA_SQL="NULL"
if [[ -n "$CA_FILE" ]]; then
  [[ -f "$CA_FILE" ]] || { echo "ERROR: CA file not found: $CA_FILE" >&2; exit 1; }
  CA_SQL="'$CA_FILE'"
fi

# Note: pg_tde must be preloaded. Use ENABLE_PG_TDE=1 so the wrapper injects it.
psql -v ON_ERROR_STOP=1 --username "${POSTGRES_USER:-postgres}" --dbname "${POSTGRES_DB:-postgres}" <<SQL
CREATE SCHEMA IF NOT EXISTS knoe;
DO $$
BEGIN
  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'knoe') THEN
    ALTER SCHEMA knoe OWNER TO knoe;
  END IF;
END
$$;

CREATE EXTENSION IF NOT EXISTS pg_tde SCHEMA knoe;
DO $$
BEGIN
  IF EXISTS (
    SELECT 1
    FROM pg_extension e
    JOIN pg_namespace n ON n.oid = e.extnamespace
    WHERE e.extname = 'pg_tde' AND n.nspname <> 'knoe'
  ) THEN
    ALTER EXTENSION pg_tde SET SCHEMA knoe;
  END IF;
END
$$;
# CREATE EXTENSION IF NOT EXISTS pg_prolelog;

SELECT pg_tde_add_global_key_provider_vault_v2(
  '${PROVIDER}',
  '${OPENBAO_ADDR}',
  '${OPENBAO_MOUNT}',
  '${TOKEN_FILE}',
  ${CA_SQL}
);

SELECT pg_tde_create_key_using_global_key_provider('${DEFAULT_KEY}', '${PROVIDER}');
SELECT pg_tde_set_default_key_using_global_key_provider('${DEFAULT_KEY}', '${PROVIDER}');
SQL