akritikos
5744f4b7db
- Implemented sync-roles.sh to synchronize Active Directory group memberships as MariaDB roles and user accounts. - Created Containerfile for building a custom ldap2pg image with patched YAML decoding. - Added provision-user-db.sh for provisioning user databases and roles based on LDAP synchronization. - Introduced a new Containerfile for MariaDB with PAM authentication via pam_ldap. - Configured PAM service for MariaDB logins and added necessary plugins for LDAP authentication. - Implemented health checks and entrypoint scripts for MariaDB and pgpool containers. - Enhanced PostgreSQL image with additional extensions and custom pg_hba.conf for improved security and functionality.
35 lines
1.7 KiB
Bash
35 lines
1.7 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Runs once on first cluster init (empty datadir), the analogue of
|
|
# init_pgpool_user.sql. Creates the infrastructure accounts (MaxScale monitor +
|
|
# service, and the replication user) on the backend. All use native password
|
|
# auth (NOT pam) — they are service accounts, not human AD logins. Passwords
|
|
# come from the environment so nothing secret is committed to a .sql file, and
|
|
# the root password goes via MYSQL_PWD (read by the client) rather than -p so it
|
|
# never appears in the process list.
|
|
|
|
: "${MARIADB_ROOT_PASSWORD:?}"
|
|
: "${MAXSCALE_MONITOR_PASSWORD:?}"
|
|
: "${MAXSCALE_SERVICE_PASSWORD:?}"
|
|
: "${MARIADB_REPL_PASSWORD:?}"
|
|
|
|
MYSQL_PWD="${MARIADB_ROOT_PASSWORD}" mariadb --protocol=socket -uroot <<SQL
|
|
-- Monitor account: mariadbmon health checks, replication state, and failover.
|
|
CREATE USER IF NOT EXISTS 'maxscale_monitor'@'%' IDENTIFIED BY '${MAXSCALE_MONITOR_PASSWORD}';
|
|
GRANT BINLOG MONITOR, SLAVE MONITOR, REPLICATION SLAVE, REPLICATION MASTER ADMIN,
|
|
REPLICATION SLAVE ADMIN, READ_ONLY ADMIN, RELOAD, PROCESS,
|
|
SHOW DATABASES, EVENT
|
|
ON *.* TO 'maxscale_monitor'@'%';
|
|
|
|
-- Service account: reads the user tables so MaxScale can authenticate clients
|
|
-- and route them (pass-through auth defers the real check to the backend PAM).
|
|
CREATE USER IF NOT EXISTS 'maxscale_service'@'%' IDENTIFIED BY '${MAXSCALE_SERVICE_PASSWORD}';
|
|
GRANT SELECT ON mysql.* TO 'maxscale_service'@'%';
|
|
GRANT SHOW DATABASES ON *.* TO 'maxscale_service'@'%';
|
|
|
|
-- Replication account: the replica's IO thread uses this to stream the binlog.
|
|
CREATE USER IF NOT EXISTS 'repl'@'%' IDENTIFIED BY '${MARIADB_REPL_PASSWORD}';
|
|
GRANT REPLICATION SLAVE ON *.* TO 'repl'@'%';
|
|
SQL
|