-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
8 changed files
with
314 additions
and
25 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| name: Build and publish the Containers | ||
|
|
||
| on: | ||
| push: | ||
| branches: | ||
| - build_workflow | ||
|
|
||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v2 | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v1 | ||
|
|
||
| - name: Set up Go | ||
| uses: actions/setup-go@v4 | ||
| with: | ||
| go-version: '1.22' | ||
|
|
||
| - name: Build base | ||
| run: | | ||
| make base |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| ARG CONTAINERSUITE | ||
| ARG BUILD | ||
| ARG BASEOS | ||
| ARG CONTAINERIMAGE | ||
|
|
||
| FROM ${CONTAINERSUITE}/base:${BASEOS}-${BUILD} AS builder | ||
|
|
||
| ARG PACKAGER | ||
|
|
||
| RUN ${PACKAGER} -y install --nodocs \ | ||
| --setopt=skip_missing_names_on_install=False \ | ||
| git \ | ||
| go \ | ||
| dumb-init \ | ||
| pgbouncer \ | ||
| && ${PACKAGER} -y clean all ; | ||
|
|
||
|
|
||
| # FROM ${CONTAINERIMAGE} | ||
| # COPY --from=builder /usr/bin/dumb-init /usr/bin/dumb-init | ||
| # COPY --from=builder ./postgres_exporter/postgres_exporter /bin/postgres_exporter | ||
|
|
||
| COPY launcher/pgbouncer/launch.sh / | ||
| COPY scripts/pgbouncer/* /etc/pgbouncer/ | ||
| # add pgbackrest-common files | ||
| ADD /scripts/nss_wrapper/nss_wrapper_pgbouncer.sh /scripts/nss_wrapper/nss_wrapper_pgbouncer.sh | ||
|
|
||
| RUN mkdir -p /etc/pgbouncer/certs && chown -R pgbouncer:pgbouncer /etc/pgbouncer | ||
|
|
||
| # EXPOSE 9187 | ||
|
|
||
| ENTRYPOINT ["/scripts/nss_wrapper/nss_wrapper_pgbouncer.sh"] | ||
|
|
||
| USER 996 | ||
|
|
||
| CMD ["/bin/sh", "/launch.sh", "init"] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| #!/bin/bash | ||
| set -ex | ||
|
|
||
| if [ "$PGUSER" = "postgres" ]; then | ||
| echo "WARNING: pgbouncer will connect with a superuser privileges!" | ||
| echo "You need to fix this as soon as possible." | ||
| fi | ||
|
|
||
| if [ -z "${CONNECTION_POOLER_CLIENT_TLS_CRT}" ]; then | ||
| openssl req -nodes -new -x509 -subj /CN=spilo.dummy.org \ | ||
| -keyout /etc/pgbouncer/certs/pgbouncer.key \ | ||
| -out /etc/pgbouncer/certs/pgbouncer.crt | ||
| # -keyout /etc/ssl/certs/pgbouncer.key \ | ||
| # -out /etc/ssl/certs/pgbouncer.crt | ||
| else | ||
| ln -s ${CONNECTION_POOLER_CLIENT_TLS_CRT} /etc/pgbouncer/certs/pgbouncer.crt | ||
| ln -s ${CONNECTION_POOLER_CLIENT_TLS_KEY} /etc/pgbouncer/certs/pgbouncer.key | ||
| if [ ! -z "${CONNECTION_POOLER_CLIENT_CA_FILE}" ]; then | ||
| ln -s ${CONNECTION_POOLER_CLIENT_CA_FILE} /etc/pgbouncer/certs/ca.crt | ||
| fi | ||
| # ln -s ${CONNECTION_POOLER_CLIENT_TLS_CRT} /etc/ssl/certs/pgbouncer.crt | ||
| # ln -s ${CONNECTION_POOLER_CLIENT_TLS_KEY} /etc/ssl/certs/pgbouncer.key | ||
| # if [ ! -z "${CONNECTION_POOLER_CLIENT_CA_FILE}" ]; then | ||
| # ln -s ${CONNECTION_POOLER_CLIENT_CA_FILE} /etc/ssl/certs/ca.crt | ||
| # fi | ||
| fi | ||
|
|
||
| envsubst < /etc/pgbouncer/pgbouncer.ini.tmpl > /etc/pgbouncer/pgbouncer.ini | ||
| envsubst < /etc/pgbouncer/auth_file.txt.tmpl > /etc/pgbouncer/auth_file.txt | ||
|
|
||
| exec /bin/pgbouncer /etc/pgbouncer/pgbouncer.ini |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| #!/bin/bash | ||
|
|
||
| # Define some needed ENVs & Variables | ||
| export NSS_USERNAME=${NSS_USERNAME:-'pgbouncer'} | ||
| export NSS_USERDESC=${NSS_USERDESC:-'pgbouncer'} | ||
| export CURRENT_USER=$(id -u) | ||
| export CURRENT_GROUP=$(id -g) | ||
|
|
||
| # Prepare Folders and Files | ||
| NSS_ROOT_DIR="/tmp/nss_wrapper" | ||
| NSS_PASSWD="${NSS_ROOT_DIR}/passwd" | ||
| NSS_GROUP="${NSS_ROOT_DIR}//group" | ||
|
|
||
| mkdir -p ${NSS_ROOT_DIR} | ||
| chmod g+rwx ${NSS_ROOT_DIR} | ||
|
|
||
| [[ -f "${NSS_PASSWD}" ]] || cp "/etc/passwd" "${NSS_PASSWD}" | ||
| [[ -f "${NSS_GROUP}" ]] || cp "/etc/group" "${NSS_GROUP}" | ||
|
|
||
| # Check if User and Group already exists, if not add it | ||
| if [[ ! $(cat "${NSS_PASSWD}") =~ ${NSS_USERNAME}:x:${CURRENT_USER} ]]; then | ||
| passwd_tmp="${NSS_WRAPPER_DIR}/passwd_tmp" | ||
| cp "${NSS_PASSWD}" "${NSS_PASSWD}.tmp" | ||
| sed -i "/${NSS_USERNAME}:x:/d" "${NSS_PASSWD}.tmp" | ||
| sed -i "/${CURRENT_USER}:x:/d" "${NSS_PASSWD}.tmp" | ||
| echo '${NSS_USERNAME}:x:${CURRENT_USER}:${CURRENT_GROUP}:${NSS_USERDESC}:${HOME}:/bin/bash\n' >> "${NSS_PASSWD}.tmp" | ||
| envsubst < "${NSS_PASSWD}.tmp" > "${NSS_PASSWD}" | ||
| rm "${NSS_PASSWD}.tmp" | ||
| echo "User was added via nss_wrapper" | ||
| fi | ||
|
|
||
| if [[ ! $(cat "${NSS_GROUP}") =~ ${NSS_USERNAME}:x:${CURRENT_USER} ]]; then | ||
| cp "${NSS_GROUP}" "${NSS_GROUP}.tmp" | ||
| sed -i "/${NSS_USERNAME}:x:/d" "${NSS_GROUP}.tmp" | ||
| printf '${NSS_USERNAME}:x:${CURRENT_USER}:${NSS_USERNAME}\n' >> "${NSS_GROUP}.tmp" | ||
| envsubst < "${NSS_GROUP}.tmp" > "${NSS_GROUP}" | ||
| rm "${NSS_GROUP}.tmp" | ||
| echo "Group was added via nss_wrapper" | ||
| fi | ||
|
|
||
| export LD_PRELOAD=/usr/lib64/libnss_wrapper.so | ||
| export NSS_WRAPPER_PASSWD="${NSS_PASSWD}" | ||
| export NSS_WRAPPER_GROUP="${NSS_GROUP}" | ||
|
|
||
| exec "$@" | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| "$PGUSER" "$PGPASSWORD" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| # vim: set ft=dosini: | ||
|
|
||
| [databases] | ||
| * = host=$PGHOST port=$PGPORT auth_user=$PGUSER | ||
| postgres = host=$PGHOST port=$PGPORT auth_user=$PGUSER | ||
|
|
||
| [pgbouncer] | ||
| pool_mode = $CONNECTION_POOLER_MODE | ||
| listen_port = $CONNECTION_POOLER_PORT | ||
| listen_addr = * | ||
| auth_type = scram-sha-256 | ||
| auth_file = /etc/pgbouncer/auth_file.txt | ||
| auth_dbname = postgres | ||
| admin_users = $PGUSER | ||
| stats_users_prefix = robot_ | ||
| auth_query = SELECT * FROM $PGSCHEMA.user_lookup($1) | ||
| logfile = /var/log/pgbouncer/pgbouncer.log | ||
| pidfile = /var/run/pgbouncer/pgbouncer.pid | ||
|
|
||
| server_tls_sslmode = require | ||
| server_tls_ca_file = /etc/pgbouncer/certs/pgbouncer.crt | ||
| server_tls_protocols = secure | ||
| client_tls_sslmode = require | ||
| client_tls_key_file = /etc/pgbouncer/certs/pgbouncer.key | ||
| client_tls_cert_file = /etc/pgbouncer/certs/pgbouncer.crt | ||
|
|
||
| log_connections = 0 | ||
| log_disconnections = 0 | ||
|
|
||
| # How many server connections to allow per user/database pair. | ||
| default_pool_size = $CONNECTION_POOLER_DEFAULT_SIZE | ||
|
|
||
| # Add more server connections to pool if below this number. Improves behavior | ||
| # when usual load comes suddenly back after period of total inactivity. | ||
| # | ||
| # NOTE: This value is per pool, i.e. a pair of (db, user), not a global one. | ||
| # Which means on the higher level it has to be calculated from the max allowed | ||
| # database connections and number of databases and users. If not taken into | ||
| # account, then for too many users or databases PgBouncer will go crazy | ||
| # opening/evicting connections. For now disable it. | ||
| # | ||
| # min_pool_size = $CONNECTION_POOLER_MIN_SIZE | ||
|
|
||
| # How many additional connections to allow to a pool | ||
| reserve_pool_size = $CONNECTION_POOLER_RESERVE_SIZE | ||
|
|
||
| # Maximum number of client connections allowed. | ||
| max_client_conn = $CONNECTION_POOLER_MAX_CLIENT_CONN | ||
|
|
||
| # Do not allow more than this many connections per database (regardless of | ||
| # pool, i.e. user) | ||
| max_db_connections = $CONNECTION_POOLER_MAX_DB_CONN | ||
|
|
||
| # If a client has been in "idle in transaction" state longer, it will be | ||
| # disconnected. [seconds] | ||
| idle_transaction_timeout = 600 | ||
|
|
||
| # If login failed, because of failure from connect() or authentication that | ||
| # pooler waits this much before retrying to connect. Default is 15. [seconds] | ||
| server_login_retry = 5 | ||
|
|
||
| # To ignore extra parameter in startup packet. By default only 'database' and | ||
| # 'user' are allowed, all others raise error. This is needed to tolerate | ||
| # overenthusiastic JDBC wanting to unconditionally set 'extra_float_digits=2' | ||
| # in startup packet. | ||
| ignore_startup_parameters = extra_float_digits,options |