akritikos
5744f4b7db
- Implemented sync-roles.sh to synchronize Active Directory group memberships as MariaDB roles and user accounts. - Created Containerfile for building a custom ldap2pg image with patched YAML decoding. - Added provision-user-db.sh for provisioning user databases and roles based on LDAP synchronization. - Introduced a new Containerfile for MariaDB with PAM authentication via pam_ldap. - Configured PAM service for MariaDB logins and added necessary plugins for LDAP authentication. - Implemented health checks and entrypoint scripts for MariaDB and pgpool containers. - Enhanced PostgreSQL image with additional extensions and custom pg_hba.conf for improved security and functionality.
116 lines
4.6 KiB
Docker
116 lines
4.6 KiB
Docker
ARG PG_MAJOR=18
|
|
ARG POSTGIS_MAJOR=3
|
|
ARG VCHORD_VERSION=1.1.1
|
|
|
|
FROM postgres:${PG_MAJOR:-18} AS base-image
|
|
WORKDIR /tmp
|
|
|
|
FROM base-image AS build-deps
|
|
ARG PG_MAJOR
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
wget \
|
|
curl \
|
|
build-essential \
|
|
cmake \
|
|
libkrb5-dev \
|
|
libicu-dev \
|
|
postgresql-server-dev-$PG_MAJOR \
|
|
&& apt-get install --reinstall -y ca-certificates \
|
|
&& update-ca-certificates
|
|
|
|
FROM build-deps AS downloads
|
|
WORKDIR /tmp
|
|
ARG PG_MAJOR
|
|
ARG VCHORD_VERSION
|
|
RUN wget https://github.com/tensorchord/VectorChord/releases/download/${VCHORD_VERSION}/postgresql-${PG_MAJOR}-vchord_${VCHORD_VERSION}-1_amd64.deb
|
|
|
|
FROM downloads AS timescaledb
|
|
ARG PG_MAJOR
|
|
WORKDIR /tmp/timescaledb
|
|
RUN URL_END=$(case "$PG_MAJOR" in ("12") echo "tag/2.11.2";; ("13") echo "tag/2.15.3";; (*) echo "latest";; esac) && \
|
|
ASSET_NAME=$(basename $(curl -LIs -o /dev/null -w %{url_effective} https://github.com/timescale/timescaledb/releases/${URL_END})) && \
|
|
curl --fail -L "https://github.com/timescale/timescaledb/archive/${ASSET_NAME}.tar.gz" | tar -zx --strip-components=1 -C . && ./bootstrap
|
|
WORKDIR /tmp/timescaledb/build
|
|
RUN make -j$(nproc) && \
|
|
make install
|
|
|
|
FROM base-image AS final
|
|
WORKDIR /tmp
|
|
ARG PG_MAJOR
|
|
ARG POSTGIS_MAJOR
|
|
ARG VCHORD_VERSION
|
|
|
|
## Install postgis, pg_hint_plan and pgvector
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
libldap-common \
|
|
postgresql-${PG_MAJOR}-postgis-${POSTGIS_MAJOR} \
|
|
postgresql-${PG_MAJOR}-postgis-${POSTGIS_MAJOR}-scripts \
|
|
postgis \
|
|
postgresql-${PG_MAJOR}-pgrouting \
|
|
postgresql-${PG_MAJOR}-pg-hint-plan \
|
|
postgresql-${PG_MAJOR}-pgvector \
|
|
&& apt-get install --reinstall -y ca-certificates
|
|
|
|
## Copy TimescaleDB from build image
|
|
COPY --from=timescaledb \
|
|
/usr/share/postgresql/$PG_MAJOR/extension/timescaledb* \
|
|
/usr/share/postgresql/$PG_MAJOR/extension/
|
|
COPY --from=timescaledb \
|
|
/usr/lib/postgresql/$PG_MAJOR/lib/timescaledb* \
|
|
/usr/lib/postgresql/$PG_MAJOR/lib/
|
|
|
|
## Install VectorChord
|
|
COPY --from=downloads /tmp/postgresql-${PG_MAJOR}-vchord_${VCHORD_VERSION}-1_amd64.deb /tmp/
|
|
RUN apt-get install -y --no-install-recommends ./postgresql-${PG_MAJOR}-vchord_${VCHORD_VERSION}-1_amd64.deb
|
|
|
|
## Mark curated extensions as trusted so non-superusers with CREATE on their
|
|
## database (e.g. app migration roles) can install them without superuser.
|
|
## These ship untrusted, otherwise yielding "permission denied to create
|
|
## extension". Safe because each only adds data types / index access methods /
|
|
## planner hints -- no filesystem, network, raw-storage, or SECURITY DEFINER
|
|
## access. Do NOT add postgis*, *_fdw, dblink, or storage-introspection modules.
|
|
RUN set -eu; \
|
|
for ext in vector vchord pg_hint_plan; do \
|
|
ctl="/usr/share/postgresql/${PG_MAJOR}/extension/${ext}.control"; \
|
|
[ -f "$ctl" ] || { echo "trusted-marking: missing $ctl" >&2; exit 1; }; \
|
|
grep -qE '^[[:space:]]*trusted[[:space:]]*=' "$ctl" \
|
|
|| printf 'trusted = true\n' >> "$ctl"; \
|
|
done
|
|
|
|
## Layered configuration (applied to every newly initialized cluster).
|
|
## initdb seeds postgresql.conf from postgresql.conf.sample, so appending
|
|
## include_dir there pulls in our config regardless of the container command.
|
|
##
|
|
## Image-owned config lives under /usr/local/etc/postgresql (conf.d + pg_hba.conf);
|
|
## /etc/postgresql holds ONLY the user override dirs (conf.d, hba.d) so that
|
|
## path is a clean "mount your files here" area.
|
|
##
|
|
## postgresql.conf: our /usr/local/etc/postgresql/conf.d loaded first, user
|
|
## /etc/postgresql/conf.d last (last-wins => users override us, but a stray
|
|
## mount can't wipe our defaults e.g. shared_preload_libraries).
|
|
##
|
|
## pg_hba.conf: conf.d/20-hba.conf points hba_file at our authoritative
|
|
## /usr/local/etc/postgresql/pg_hba.conf, which fully replaces the initdb-
|
|
## generated file (and sidesteps the entrypoint's appended "host all all all
|
|
## <method>" line, written to the now-unused PGDATA copy). Tier order in that
|
|
## file: local allows -> include_dir /etc/postgresql/hba.d -> default-deny.
|
|
COPY conf.d/ /usr/local/etc/postgresql/conf.d/
|
|
COPY pg_hba.conf /usr/local/etc/postgresql/pg_hba.conf
|
|
RUN mkdir -p /etc/postgresql/conf.d \
|
|
/etc/postgresql/hba.d \
|
|
&& { \
|
|
echo "include_dir = '/usr/local/etc/postgresql/conf.d'"; \
|
|
echo "include_dir = '/etc/postgresql/conf.d'"; \
|
|
} >> /usr/share/postgresql/${PG_MAJOR}/postgresql.conf.sample
|
|
|
|
## Clean image
|
|
RUN rm -rf /var/lib/apt/lists/* \
|
|
&& rm -rf /tmp/*
|
|
|
|
## Report health via pg_isready (env vars expand at runtime via /bin/sh -c).
|
|
HEALTHCHECK --interval=10s --timeout=5s --retries=5 --start-period=2s \
|
|
CMD pg_isready --dbname="${POSTGRES_DB:-postgres}" --username="${POSTGRES_USER:-postgres}" || exit 1
|
|
|
|
WORKDIR /var/lib/postgresql/data
|