diff --git a/bitnami/postgresql-repmgr/18/debian-12/Dockerfile b/bitnami/postgresql-repmgr/18/debian-12/Dockerfile index 17cb6caebf25..fd062b5d0073 100644 --- a/bitnami/postgresql-repmgr/18/debian-12/Dockerfile +++ b/bitnami/postgresql-repmgr/18/debian-12/Dockerfile @@ -7,7 +7,7 @@ ARG DOWNLOADS_URL="downloads.bitnami.com/files/stacksmith" ARG TARGETARCH LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \ - org.opencontainers.image.created="2026-05-23T10:36:31Z" \ + org.opencontainers.image.created="2026-05-28T11:34:21Z" \ org.opencontainers.image.description="Application packaged by Broadcom, Inc." \ org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/postgresql-repmgr/README.md" \ org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/postgresql-repmgr" \ @@ -34,12 +34,12 @@ RUN --mount=type=secret,id=downloads_url,env=SECRET_DOWNLOADS_URL \ for COMPONENT in "${COMPONENTS[@]}"; do \ if [ ! -f "${COMPONENT}.tar.gz" ]; then \ curl -SsLf "https://${DOWNLOADS_URL}/${COMPONENT}.tar.gz" -O ; \ - curl -SsLf "https://${DOWNLOADS_URL}/${COMPONENT}.tar.gz.sha256" -O ; \ fi ; \ - sha256sum -c "${COMPONENT}.tar.gz.sha256" ; \ + sha256sum -c "/opt/bitnami/checksums/${COMPONENT}.tar.gz.sha256" ; \ tar -zxf "${COMPONENT}.tar.gz" -C /opt/bitnami --strip-components=2 --no-same-owner ; \ - rm -rf "${COMPONENT}".tar.gz{,.sha256} ; \ - done + rm -rf "${COMPONENT}".tar.gz ; \ + done ; \ + rm -rf /opt/bitnami/checksums ; RUN apt-get update && apt-get upgrade -y && \ apt-get clean && rm -rf /var/lib/apt/lists /var/cache/apt/archives RUN chmod g+rwX /opt/bitnami @@ -55,7 +55,7 @@ COPY rootfs / RUN /opt/bitnami/scripts/postgresql-repmgr/postunpack.sh ENV APP_VERSION="18.4.0" \ BITNAMI_APP_NAME="postgresql-repmgr" \ - IMAGE_REVISION="4" \ + IMAGE_REVISION="5" \ LANG="en_US.UTF-8" \ LANGUAGE="en_US:en" \ NSS_WRAPPER_LIB="/opt/bitnami/common/lib/libnss_wrapper.so" \ diff --git a/bitnami/postgresql-repmgr/18/debian-12/prebuildfs/opt/bitnami/checksums/nss-wrapper-1.1.16-0-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/postgresql-repmgr/18/debian-12/prebuildfs/opt/bitnami/checksums/nss-wrapper-1.1.16-0-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..cf2734607b9e --- /dev/null +++ b/bitnami/postgresql-repmgr/18/debian-12/prebuildfs/opt/bitnami/checksums/nss-wrapper-1.1.16-0-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +af31040a9ef21924a1d4c6d3f0bd6a6be9ef701c9e726b9b3997b82394779b6e nss-wrapper-1.1.16-0-linux-amd64-debian-12.tar.gz diff --git a/bitnami/postgresql-repmgr/18/debian-12/prebuildfs/opt/bitnami/checksums/nss-wrapper-1.1.16-0-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/postgresql-repmgr/18/debian-12/prebuildfs/opt/bitnami/checksums/nss-wrapper-1.1.16-0-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..c4594d6aa7c5 --- /dev/null +++ b/bitnami/postgresql-repmgr/18/debian-12/prebuildfs/opt/bitnami/checksums/nss-wrapper-1.1.16-0-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +9315fee0fbce2e445778f4cddd4b5a9ae657d40bcc4c9534430d8eaeecf7307c nss-wrapper-1.1.16-0-linux-arm64-debian-12.tar.gz diff --git a/bitnami/postgresql-repmgr/18/debian-12/prebuildfs/opt/bitnami/checksums/postgresql-repmgr-18.4.0-0-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/postgresql-repmgr/18/debian-12/prebuildfs/opt/bitnami/checksums/postgresql-repmgr-18.4.0-0-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..e712eb3aff1b --- /dev/null +++ b/bitnami/postgresql-repmgr/18/debian-12/prebuildfs/opt/bitnami/checksums/postgresql-repmgr-18.4.0-0-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +ac8f5deb7f4bbb9f2233efc1e36766d14168765e6944e339251f7462bc72fcae postgresql-repmgr-18.4.0-0-linux-amd64-debian-12.tar.gz diff --git a/bitnami/postgresql-repmgr/18/debian-12/prebuildfs/opt/bitnami/checksums/postgresql-repmgr-18.4.0-0-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/postgresql-repmgr/18/debian-12/prebuildfs/opt/bitnami/checksums/postgresql-repmgr-18.4.0-0-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..a1ed5243b005 --- /dev/null +++ b/bitnami/postgresql-repmgr/18/debian-12/prebuildfs/opt/bitnami/checksums/postgresql-repmgr-18.4.0-0-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +50f7c2620a112785b3821806345863196a561857dba0bcb98f4b4f7333bd0559 postgresql-repmgr-18.4.0-0-linux-arm64-debian-12.tar.gz diff --git a/bitnami/postgresql-repmgr/18/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh b/bitnami/postgresql-repmgr/18/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh index 1c69e0e48a5d..335c1c7c9ef7 100644 --- a/bitnami/postgresql-repmgr/18/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh +++ b/bitnami/postgresql-repmgr/18/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh @@ -139,3 +139,40 @@ wait_for_log_entry() { return 1 fi } + +######################## +# Creates a secure temporary file containing the provided secret +# Arguments: +# $1 - secret to write to the temporary file +# Returns: +# String +######################### +credential_to_temp_file() { + local secret="$1" + local tmp_file + + # Use mktemp with a specific prefix for easier debugging if something lingers + if ! tmp_file=$(mktemp "${TMPDIR:-/tmp}/at.cred.XXXXXXXX"); then + echo "Error: Failed to create temp file" >&2 + return 1 + fi + + # Restrict permissions before writing the secret + chmod 0600 "$tmp_file" + # Write secret and ensure it's flushed to disk + printf "%s" "$secret" > "$tmp_file" + # Output the filename so the caller can capture it + echo "$tmp_file" +} + +######################## +# Cleans up temporary files created by credential_to_temp_file +# Arguments: +# None +# Returns: +# None +######################### +cleanup_credentials() { + debug "Cleaning up temporary files containing credentials" + rm -rf "${TMPDIR:-/tmp}"/at.cred.* +} diff --git a/bitnami/postgresql-repmgr/18/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh b/bitnami/postgresql-repmgr/18/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh index 1337f6c2dd59..b16efabd3230 100644 --- a/bitnami/postgresql-repmgr/18/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh +++ b/bitnami/postgresql-repmgr/18/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh @@ -131,6 +131,7 @@ relativize() { # -d|--dir-mode - mode for files. # -u|--user - user # -g|--group - group +# -n|--no-dereference - do not follow symlinks (use for runtime root chown of daemon-writable dirs) # Returns: # None ######################### @@ -140,6 +141,7 @@ configure_permissions_ownership() { local file_mode="" local user="" local group="" + local follow_symlinks="yes" # Validate arguments shift 1 @@ -161,6 +163,9 @@ configure_permissions_ownership() { shift group="${1:?missing group}" ;; + -n | --no-dereference) + follow_symlinks="no" + ;; *) echo "Invalid command line flag $1" >&2 return 1 @@ -169,22 +174,29 @@ configure_permissions_ownership() { shift done + # -L: follow symlinks and emits the target path + # This is dangerous at runtime, given a co-located lower-privileged process with write access + # to the target path can redirect the chown/chmod to arbitrary paths. Example: + # Lower-privileged process run: ln -s /etc /tmp/etc + # Then, setup.sh runs: configure_permissions_ownership --dir-mode 775 /tmp + local find_L_flag=(); [[ "$follow_symlinks" == "yes" ]] && find_L_flag=("-L") + # -h: changes symlink inode ownership without touching the target. + local chown_flags=(); [[ "$follow_symlinks" == "no" ]] && chown_flags=("-h") read -r -a filepaths <<<"$paths" for p in "${filepaths[@]}"; do if [[ -e "$p" ]]; then - find -L "$p" -printf "" if [[ -n $dir_mode ]]; then - find -L "$p" -type d ! -perm "$dir_mode" -print0 | xargs -r -0 chmod "$dir_mode" + find "${find_L_flag[@]}" "$p" -not -type l -type d ! -perm "$dir_mode" -print0 | xargs -r -0 chmod "$dir_mode" fi if [[ -n $file_mode ]]; then - find -L "$p" -type f ! -perm "$file_mode" -print0 | xargs -r -0 chmod "$file_mode" + find "${find_L_flag[@]}" "$p" -not -type l -type f ! -perm "$file_mode" -print0 | xargs -r -0 chmod "$file_mode" fi if [[ -n $user ]] && [[ -n $group ]]; then - find -L "$p" -print0 | xargs -r -0 chown "${user}:${group}" + find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chown "${chown_flags[@]}" "${user}:${group}" elif [[ -n $user ]] && [[ -z $group ]]; then - find -L "$p" -print0 | xargs -r -0 chown "${user}" + find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chown "${chown_flags[@]}" "${user}" elif [[ -z $user ]] && [[ -n $group ]]; then - find -L "$p" -print0 | xargs -r -0 chgrp "${group}" + find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chgrp "${chown_flags[@]}" "${group}" fi else stderr_print "$p does not exist" diff --git a/bitnami/postgresql-repmgr/18/debian-12/rootfs/opt/bitnami/scripts/libpostgresql.sh b/bitnami/postgresql-repmgr/18/debian-12/rootfs/opt/bitnami/scripts/libpostgresql.sh index e0481e0240c3..0976eb2406a1 100644 --- a/bitnami/postgresql-repmgr/18/debian-12/rootfs/opt/bitnami/scripts/libpostgresql.sh +++ b/bitnami/postgresql-repmgr/18/debian-12/rootfs/opt/bitnami/scripts/libpostgresql.sh @@ -55,22 +55,25 @@ postgresql_validate() { error "$1" error_code=1 } - check_multi_value() { if [[ " ${2} " != *" ${!1} "* ]]; then print_validation_error "The allowed values for ${1} are: ${2}" fi } - empty_password_enabled_warn() { warn "You set the environment variable ALLOW_EMPTY_PASSWORD=${ALLOW_EMPTY_PASSWORD}. For safety reasons, do not use this flag in a production environment." } empty_password_error() { print_validation_error "The $1 environment variable is empty or not set. Set the environment variable ALLOW_EMPTY_PASSWORD=yes to allow the container to be started with blank passwords. This is recommended only for development." } + + check_multi_value "POSTGRESQL_PGHBA_AUTH_METHOD" "md5 scram-sha-256" if is_boolean_yes "$ALLOW_EMPTY_PASSWORD"; then empty_password_enabled_warn else + if [[ "$POSTGRESQL_PGHBA_AUTH_METHOD" = "md5" ]]; then + warn "POSTGRESQL_AUTH_METHOD is 'md5': md5 format is vulnerable to pass-the-hash attacks. Please consider using 'scram-sha-256' instead." + fi if [[ -z "$POSTGRESQL_PASSWORD" ]]; then empty_password_error "POSTGRESQL_PASSWORD" fi @@ -127,6 +130,10 @@ postgresql_validate() { empty_password_error "You can not set POSTGRESQL_LDAP_URL and POSTGRESQL_LDAP_SERVER at the same time. Check your LDAP configuration." fi + if is_boolean_yes "$POSTGRESQL_ENABLE_LDAP" && is_boolean_yes "$ALLOW_EMPTY_PASSWORD"; then + print_validation_error "You cannot enable LDAP authentication and allow empty passwords at the same time." + fi + if ! is_yes_no_value "$POSTGRESQL_SR_CHECK"; then print_validation_error "The values allowed for POSTGRESQL_SR_CHECK are: yes or no" elif is_boolean_yes "$POSTGRESQL_SR_CHECK" && [[ -z "$POSTGRESQL_SR_CHECK_USERNAME" || -z "$POSTGRESQL_SR_CHECK_DATABASE" ]]; then @@ -220,7 +227,15 @@ postgresql_ldap_auth_configuration() { [[ -n "$POSTGRESQL_LDAP_PORT" ]] && ldap_configuration+=" ldapport=${POSTGRESQL_LDAP_PORT}" [[ -n "$POSTGRESQL_LDAP_BASE_DN" ]] && ldap_configuration+=" ldapbasedn=\"${POSTGRESQL_LDAP_BASE_DN}\"" [[ -n "$POSTGRESQL_LDAP_BIND_DN" ]] && ldap_configuration+=" ldapbinddn=\"${POSTGRESQL_LDAP_BIND_DN}\"" - [[ -n "$POSTGRESQL_LDAP_BIND_PASSWORD" ]] && ldap_configuration+=" ldapbindpasswd=${POSTGRESQL_LDAP_BIND_PASSWORD}" + if [[ -n "$POSTGRESQL_LDAP_BIND_PASSWORD" ]]; then + if is_boolean_yes "$POSTGRESQL_LDAP_BIND_USE_PASSFILE" && [[ ! -f "${POSTGRESQL_LDAP_BIND_PASSFILE_PATH}" ]]; then + install -m 600 /dev/null "$POSTGRESQL_LDAP_BIND_PASSFILE_PATH" + echo "$POSTGRESQL_LDAP_BIND_PASSWORD" >> "$POSTGRESQL_LDAP_BIND_PASSFILE_PATH" + ldap_opts+=" ldapbindpasswdfile=${POSTGRESQL_LDAP_BIND_PASSFILE_PATH}" + else + ldap_opts+=" ldapbindpasswd=\"${POSTGRESQL_LDAP_BIND_PASSWORD}\"" + fi + fi [[ -n "$POSTGRESQL_LDAP_SEARCH_ATTR" ]] && ldap_configuration+=" ldapsearchattribute=${POSTGRESQL_LDAP_SEARCH_ATTR}" [[ -n "$POSTGRESQL_LDAP_SEARCH_FILTER" ]] && ldap_configuration+=" ldapsearchfilter=\"${POSTGRESQL_LDAP_SEARCH_FILTER}\"" [[ -n "$POSTGRESQL_LDAP_TLS" ]] && ldap_configuration+=" ldaptls=${POSTGRESQL_LDAP_TLS}" @@ -321,7 +336,7 @@ EOF ######################### postgresql_restrict_pghba() { if [[ -n "$POSTGRESQL_PASSWORD" ]]; then - replace_in_file "$POSTGRESQL_PGHBA_FILE" "trust" "md5" false + replace_in_file "$POSTGRESQL_PGHBA_FILE" "trust" "$POSTGRESQL_PGHBA_AUTH_METHOD" false fi } @@ -337,7 +352,7 @@ postgresql_restrict_pghba() { postgresql_add_replication_to_pghba() { local replication_auth="trust" if [[ -n "$POSTGRESQL_REPLICATION_PASSWORD" ]]; then - replication_auth="md5" + replication_auth="$POSTGRESQL_PGHBA_AUTH_METHOD" fi cat <>"$POSTGRESQL_PGHBA_FILE" host replication all 0.0.0.0/0 ${replication_auth} @@ -357,7 +372,7 @@ EOF postgresql_add_sr_check_user_to_pghba() { local sr_check_auth="trust" if [[ -n "$POSTGRESQL_SR_CHECK_PASSWORD" ]]; then - sr_check_auth="md5" + sr_check_auth="$POSTGRESQL_PGHBA_AUTH_METHOD" fi cat <>"$POSTGRESQL_PGHBA_FILE" host $POSTGRESQL_SR_CHECK_DATABASE $POSTGRESQL_SR_CHECK_USERNAME 0.0.0.0/0 ${sr_check_auth} diff --git a/bitnami/postgresql-repmgr/18/debian-12/rootfs/opt/bitnami/scripts/librepmgr.sh b/bitnami/postgresql-repmgr/18/debian-12/rootfs/opt/bitnami/scripts/librepmgr.sh index dae971d51ce0..5c5c47404084 100644 --- a/bitnami/postgresql-repmgr/18/debian-12/rootfs/opt/bitnami/scripts/librepmgr.sh +++ b/bitnami/postgresql-repmgr/18/debian-12/rootfs/opt/bitnami/scripts/librepmgr.sh @@ -10,6 +10,7 @@ . /opt/bitnami/scripts/libfile.sh . /opt/bitnami/scripts/libfs.sh . /opt/bitnami/scripts/liblog.sh +. /opt/bitnami/scripts/libnet.sh . /opt/bitnami/scripts/libos.sh . /opt/bitnami/scripts/libvalidations.sh . /opt/bitnami/scripts/libnet.sh @@ -202,6 +203,7 @@ repmgr_get_upstream_node() { elif [[ "$(echo "$primary_conninfo" | wc -l)" -eq 1 ]]; then suggested_primary_host="$(echo "$primary_conninfo" | awk -F 'host=' '{print $2}' | awk '{print $1}')" suggested_primary_port="$(echo "$primary_conninfo" | awk -F 'port=' '{print $2}' | awk '{print $1}')" + repmgr_validate_host_port "$suggested_primary_host" "$suggested_primary_port" || continue debug "Pretending primary role node - '${suggested_primary_host}:${suggested_primary_port}'" if [[ -n "$pretending_primary_host" ]]; then if [[ "${pretending_primary_host}:${pretending_primary_port}" != "${suggested_primary_host}:${suggested_primary_port}" ]]; then @@ -311,11 +313,9 @@ repmgr_set_role() { role="witness" fi - cat <>"${POSTGRESQL_MOUNTED_CONF_DIR}/pg_hba.conf" <>"${REPMGR_CONF_FILE}.tmp" event_notification_command='${REPMGR_EVENTS_DIR}/router.sh %n %e %s "%t" "%d"' -ssh_options='-o "StrictHostKeyChecking no" -v' +ssh_options='${REPMGR_SSH_OPTIONS}' use_replication_slots='${REPMGR_USE_REPLICATION_SLOTS}' pg_bindir='${POSTGRESQL_BIN_DIR}' @@ -952,3 +952,19 @@ repmgr_check_status() { return 0 } + +######################## +# Validate host and port +# Arguments: +# $1 - host +# $2 - port +# Returns: +# 0 if the validation succeeded, 1 otherwise +######################### +repmgr_validate_host_port() { + local host="${1:?missing host}" + local port="${2:?missing port}" + + is_hostname_resolved "$host" || return 1 + validate_port "$port" || return 1 +} diff --git a/bitnami/postgresql-repmgr/18/debian-12/rootfs/opt/bitnami/scripts/postgresql-env.sh b/bitnami/postgresql-repmgr/18/debian-12/rootfs/opt/bitnami/scripts/postgresql-env.sh index 9b662d6c0cdf..cebe05103318 100644 --- a/bitnami/postgresql-repmgr/18/debian-12/rootfs/opt/bitnami/scripts/postgresql-env.sh +++ b/bitnami/postgresql-repmgr/18/debian-12/rootfs/opt/bitnami/scripts/postgresql-env.sh @@ -62,6 +62,8 @@ postgresql_env_vars=( POSTGRESQL_LDAP_BASE_DN POSTGRESQL_LDAP_BIND_DN POSTGRESQL_LDAP_BIND_PASSWORD + POSTGRESQL_LDAP_BIND_USE_PASSFILE + POSTGRESQL_LDAP_BIND_PASSFILE_PATH POSTGRESQL_LDAP_SEARCH_ATTR POSTGRESQL_LDAP_SEARCH_FILTER POSTGRESQL_INITSCRIPTS_USERNAME @@ -92,6 +94,7 @@ postgresql_env_vars=( POSTGRESQL_TCP_KEEPALIVES_INTERVAL POSTGRESQL_TCP_KEEPALIVES_COUNT POSTGRESQL_STATEMENT_TIMEOUT + POSTGRESQL_PGHBA_AUTH_METHOD POSTGRESQL_PGHBA_REMOVE_FILTERS POSTGRESQL_USERNAME_CONNECTION_LIMIT POSTGRESQL_POSTGRES_CONNECTION_LIMIT @@ -101,10 +104,6 @@ postgresql_env_vars=( POSTGRESQL_DEFAULT_TRANSACTION_ISOLATION POSTGRESQL_REPLICATION_NODES POSTGRESQL_PERFORM_RESTORE - POSTGRESQL_AUTOCTL_CONF_DIR - POSTGRESQL_AUTOCTL_MODE - POSTGRESQL_AUTOCTL_MONITOR_HOST - POSTGRESQL_AUTOCTL_HOSTNAME REPMGR_DATA_DIR REPMGR_SKIP_SETUP REPMGR_NODE_ID @@ -136,6 +135,7 @@ postgresql_env_vars=( REPMGR_CHILD_NODES_CHECK_INTERVAL REPMGR_CHILD_NODES_CONNECTED_MIN_COUNT REPMGR_CHILD_NODES_DISCONNECT_TIMEOUT + REPMGR_SSH_OPTIONS REPMGR_SWITCH_ROLE REPMGR_USERNAME REPMGR_DATABASE @@ -209,6 +209,7 @@ postgresql_env_vars=( POSTGRES_TCP_KEEPALIVES_INTERVAL POSTGRES_TCP_KEEPALIVES_COUNT POSTGRES_STATEMENT_TIMEOUT + POSTGRES_PGHBA_AUTH_METHOD POSTGRES_PGHBA_REMOVE_FILTERS POSTGRES_USER_CONNECTION_LIMIT POSTGRES_POSTGRES_CONNECTION_LIMIT @@ -283,7 +284,7 @@ POSTGRESQL_REPLICATION_MODE="${POSTGRESQL_REPLICATION_MODE:-"${POSTGRES_REPLICAT export POSTGRESQL_REPLICATION_MODE="${POSTGRESQL_REPLICATION_MODE:-master}" POSTGRESQL_REPLICATION_USER="${POSTGRESQL_REPLICATION_USER:-"${POSTGRES_REPLICATION_USER:-}"}" export POSTGRESQL_REPLICATION_USER="${POSTGRESQL_REPLICATION_USER:-}" -export POSTGRESQL_REPLICATION_USE_PASSFILE="${POSTGRESQL_REPLICATION_USE_PASSFILE:-no}" +export POSTGRESQL_REPLICATION_USE_PASSFILE="${POSTGRESQL_REPLICATION_USE_PASSFILE:-yes}" export POSTGRESQL_REPLICATION_PASSFILE_PATH="${POSTGRESQL_REPLICATION_PASSFILE_PATH:-${POSTGRESQL_CONF_DIR}/.pgpass}" POSTGRESQL_SR_CHECK="${POSTGRESQL_SR_CHECK:-"${POSTGRES_SR_CHECK:-}"}" export POSTGRESQL_SR_CHECK="${POSTGRESQL_SR_CHECK:-no}" @@ -321,6 +322,8 @@ POSTGRESQL_LDAP_BIND_DN="${POSTGRESQL_LDAP_BIND_DN:-"${POSTGRES_LDAP_BIND_DN:-}" export POSTGRESQL_LDAP_BIND_DN="${POSTGRESQL_LDAP_BIND_DN:-}" POSTGRESQL_LDAP_BIND_PASSWORD="${POSTGRESQL_LDAP_BIND_PASSWORD:-"${POSTGRES_LDAP_BIND_PASSWORD:-}"}" export POSTGRESQL_LDAP_BIND_PASSWORD="${POSTGRESQL_LDAP_BIND_PASSWORD:-}" +export POSTGRESQL_LDAP_BIND_USE_PASSFILE="${POSTGRESQL_LDAP_BIND_USE_PASSFILE:-yes}" +export POSTGRESQL_LDAP_BIND_PASSFILE_PATH="${POSTGRESQL_LDAP_BIND_PASSFILE_PATH:-${POSTGRESQL_CONF_DIR}/.ldap_bindpass}" POSTGRESQL_LDAP_SEARCH_ATTR="${POSTGRESQL_LDAP_SEARCH_ATTR:-"${POSTGRES_LDAP_SEARCH_ATTR:-}"}" export POSTGRESQL_LDAP_SEARCH_ATTR="${POSTGRESQL_LDAP_SEARCH_ATTR:-}" POSTGRESQL_LDAP_SEARCH_FILTER="${POSTGRESQL_LDAP_SEARCH_FILTER:-"${POSTGRES_LDAP_SEARCH_FILTER:-}"}" @@ -381,6 +384,8 @@ POSTGRESQL_TCP_KEEPALIVES_COUNT="${POSTGRESQL_TCP_KEEPALIVES_COUNT:-"${POSTGRES_ export POSTGRESQL_TCP_KEEPALIVES_COUNT="${POSTGRESQL_TCP_KEEPALIVES_COUNT:-}" POSTGRESQL_STATEMENT_TIMEOUT="${POSTGRESQL_STATEMENT_TIMEOUT:-"${POSTGRES_STATEMENT_TIMEOUT:-}"}" export POSTGRESQL_STATEMENT_TIMEOUT="${POSTGRESQL_STATEMENT_TIMEOUT:-}" +POSTGRESQL_PGHBA_AUTH_METHOD="${POSTGRESQL_PGHBA_AUTH_METHOD:-"${POSTGRES_PGHBA_AUTH_METHOD:-}"}" +export POSTGRESQL_PGHBA_AUTH_METHOD="${POSTGRESQL_PGHBA_AUTH_METHOD:-md5}" POSTGRESQL_PGHBA_REMOVE_FILTERS="${POSTGRESQL_PGHBA_REMOVE_FILTERS:-"${POSTGRES_PGHBA_REMOVE_FILTERS:-}"}" export POSTGRESQL_PGHBA_REMOVE_FILTERS="${POSTGRESQL_PGHBA_REMOVE_FILTERS:-}" POSTGRESQL_USERNAME_CONNECTION_LIMIT="${POSTGRESQL_USERNAME_CONNECTION_LIMIT:-"${POSTGRES_USER_CONNECTION_LIMIT:-}"}" @@ -397,13 +402,6 @@ export POSTGRESQL_REPLICATION_NODES="${POSTGRESQL_REPLICATION_NODES:-}" # Native recovery settings export POSTGRESQL_PERFORM_RESTORE="${POSTGRESQL_PERFORM_RESTORE:-no}" -# pgAutoFailover settings -export POSTGRESQL_AUTOCTL_VOLUME_DIR="${POSTGRESQL_VOLUME_DIR}/pgautoctl" -export POSTGRESQL_AUTOCTL_CONF_DIR="${POSTGRESQL_AUTOCTL_CONF_DIR:-${POSTGRESQL_AUTOCTL_VOLUME_DIR}/.config}" -export POSTGRESQL_AUTOCTL_MODE="${POSTGRESQL_AUTOCTL_MODE:-postgres}" -export POSTGRESQL_AUTOCTL_MONITOR_HOST="${POSTGRESQL_AUTOCTL_MONITOR_HOST:-monitor}" -export POSTGRESQL_AUTOCTL_HOSTNAME="${POSTGRESQL_AUTOCTL_HOSTNAME:-$(hostname --fqdn)}" - # pgBackRest settings export POSTGRESQL_PGBACKREST_VOLUME_DIR="${POSTGRESQL_VOLUME_DIR}/pgbackrest" export POSTGRESQL_PGBACKREST_LOGS_DIR="${POSTGRESQL_PGBACKREST_VOLUME_DIR}/logs" @@ -462,6 +460,7 @@ export REPMGR_FAILOVER="${REPMGR_FAILOVER:-automatic}" export REPMGR_CHILD_NODES_CHECK_INTERVAL="${REPMGR_CHILD_NODES_CHECK_INTERVAL:-5}" export REPMGR_CHILD_NODES_CONNECTED_MIN_COUNT="${REPMGR_CHILD_NODES_CONNECTED_MIN_COUNT:-1}" export REPMGR_CHILD_NODES_DISCONNECT_TIMEOUT="${REPMGR_CHILD_NODES_DISCONNECT_TIMEOUT:-30}" +export REPMGR_SSH_OPTIONS="${REPMGR_SSH_OPTIONS:--o StrictHostKeyChecking=accept-new}" # Internal (Replication Manager) export REPMGR_SWITCH_ROLE="${REPMGR_SWITCH_ROLE:-no}" @@ -473,7 +472,7 @@ export REPMGR_USERNAME="${REPMGR_USERNAME:-repmgr}" export REPMGR_DATABASE="${REPMGR_DATABASE:-repmgr}" export REPMGR_PGHBA_TRUST_ALL="${REPMGR_PGHBA_TRUST_ALL:-no}" export REPMGR_PASSWORD="${REPMGR_PASSWORD:-}" -export REPMGR_USE_PASSFILE="${REPMGR_USE_PASSFILE:-}" +export REPMGR_USE_PASSFILE="${REPMGR_USE_PASSFILE:-yes}" export REPMGR_PASSFILE_PATH="${REPMGR_PASSFILE_PATH:-$REPMGR_CONF_DIR/.pgpass}" # PostgreSQL env var (Replication Manager) diff --git a/bitnami/postgresql-repmgr/18/debian-12/rootfs/opt/bitnami/scripts/postgresql-repmgr/setup.sh b/bitnami/postgresql-repmgr/18/debian-12/rootfs/opt/bitnami/scripts/postgresql-repmgr/setup.sh index 82d0713ca77a..8da669473824 100755 --- a/bitnami/postgresql-repmgr/18/debian-12/rootfs/opt/bitnami/scripts/postgresql-repmgr/setup.sh +++ b/bitnami/postgresql-repmgr/18/debian-12/rootfs/opt/bitnami/scripts/postgresql-repmgr/setup.sh @@ -23,7 +23,7 @@ repmgr_validate postgresql_validate # Set the environment variables for the node's role -eval "$(repmgr_set_role)" +repmgr_set_role # Ensure PostgreSQL is stopped when this script ends. trap "postgresql_stop" EXIT diff --git a/bitnami/postgresql-repmgr/README.md b/bitnami/postgresql-repmgr/README.md index 95e29d6f3267..f41863443025 100644 --- a/bitnami/postgresql-repmgr/README.md +++ b/bitnami/postgresql-repmgr/README.md @@ -78,129 +78,129 @@ The following tables list the main variables you can set. #### Customizable environment variables -| Name | Description | Default Value | -|--------------------------------------------|------------------------------------------------------------------------------------------------------|--------------------------------------------| -| `POSTGRESQL_VOLUME_DIR` | Persistence base directory | `/bitnami/postgresql` | -| `POSTGRESQL_DATA_DIR` | PostgreSQL data directory | `${POSTGRESQL_VOLUME_DIR}/data` | -| `POSTGRESQL_EXTRA_FLAGS` | Extra flags for PostgreSQL initialization | `nil` | -| `POSTGRESQL_INIT_MAX_TIMEOUT` | Maximum initialization waiting timeout | `60` | -| `POSTGRESQL_PGCTLTIMEOUT` | Maximum waiting timeout for pg_ctl commands | `60` | -| `POSTGRESQL_SHUTDOWN_MODE` | Default mode for pg_ctl stop command | `fast` | -| `POSTGRESQL_CLUSTER_APP_NAME` | Replication cluster default application name | `walreceiver` | -| `POSTGRESQL_DATABASE` | Default PostgreSQL database | `postgres` | -| `POSTGRESQL_INITDB_ARGS` | Optional args for PostreSQL initdb operation | `nil` | -| `ALLOW_EMPTY_PASSWORD` | Allow password-less access | `no` | -| `POSTGRESQL_INITDB_WAL_DIR` | Optional init db wal directory | `nil` | -| `POSTGRESQL_MASTER_HOST` | PostgreSQL master host (used by slaves) | `nil` | -| `POSTGRESQL_MASTER_PORT_NUMBER` | PostgreSQL master host port (used by slaves) | `5432` | -| `POSTGRESQL_NUM_SYNCHRONOUS_REPLICAS` | Number of PostgreSQL replicas that should use synchronous replication | `0` | -| `POSTGRESQL_SYNCHRONOUS_REPLICAS_MODE` | PostgreSQL synchronous replication mode (values: empty, FIRST, ANY) | `nil` | -| `POSTGRESQL_PORT_NUMBER` | PostgreSQL port number | `5432` | -| `POSTGRESQL_ALLOW_REMOTE_CONNECTIONS` | Modify pg_hba settings so users can access from the outside | `yes` | -| `POSTGRESQL_REPLICATION_MODE` | PostgreSQL replication mode (values: master, slave) | `master` | -| `POSTGRESQL_REPLICATION_USER` | PostgreSQL replication user | `nil` | -| `POSTGRESQL_REPLICATION_USE_PASSFILE` | Use PGPASSFILE instead of PGPASSWORD | `no` | -| `POSTGRESQL_REPLICATION_PASSFILE_PATH` | Path to store passfile | `${POSTGRESQL_CONF_DIR}/.pgpass` | -| `POSTGRESQL_SR_CHECK` | Create user on PostgreSQL for Stream Replication Check | `no` | -| `POSTGRESQL_SR_CHECK_USERNAME` | Stream Replication Check user | `sr_check_user` | -| `POSTGRESQL_SR_CHECK_DATABASE` | Stream Replication Check database | `postgres` | -| `POSTGRESQL_SYNCHRONOUS_COMMIT_MODE` | Enable synchronous replication in slaves (number defined by POSTGRESQL_NUM_SYNCHRONOUS_REPLICAS) | `on` | -| `POSTGRESQL_FSYNC` | Enable fsync in write ahead logs | `on` | -| `POSTGRESQL_USERNAME` | PostgreSQL default username | `postgres` | -| `POSTGRESQL_ENABLE_LDAP` | Enable LDAP for PostgreSQL authentication | `no` | -| `POSTGRESQL_LDAP_URL` | PostgreSQL LDAP server url (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | -| `POSTGRESQL_LDAP_PREFIX` | PostgreSQL LDAP prefix (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | -| `POSTGRESQL_LDAP_SUFFIX` | PostgreSQL LDAP suffix (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | -| `POSTGRESQL_LDAP_SERVER` | PostgreSQL LDAP server (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | -| `POSTGRESQL_LDAP_PORT` | PostgreSQL LDAP port (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | -| `POSTGRESQL_LDAP_SCHEME` | PostgreSQL LDAP scheme (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | -| `POSTGRESQL_LDAP_TLS` | PostgreSQL LDAP tls setting (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | -| `POSTGRESQL_LDAP_BASE_DN` | PostgreSQL LDAP base DN settings (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | -| `POSTGRESQL_LDAP_BIND_DN` | PostgreSQL LDAP bind DN settings (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | -| `POSTGRESQL_LDAP_BIND_PASSWORD` | PostgreSQL LDAP bind password (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | -| `POSTGRESQL_LDAP_SEARCH_ATTR` | PostgreSQL LDAP search attribute (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | -| `POSTGRESQL_LDAP_SEARCH_FILTER` | PostgreSQL LDAP search filter (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | -| `POSTGRESQL_INITSCRIPTS_USERNAME` | Username for the psql scripts included in /docker-entrypoint.initdb | `$POSTGRESQL_USERNAME` | -| `POSTGRESQL_PASSWORD` | Password for the PostgreSQL created user | `nil` | -| `POSTGRESQL_POSTGRES_PASSWORD` | Password for the PostgreSQL postgres user | `nil` | -| `POSTGRESQL_REPLICATION_PASSWORD` | Password for the PostgreSQL replication user | `nil` | -| `POSTGRESQL_SR_CHECK_PASSWORD` | Password for the Stream Replication Check user | `nil` | -| `POSTGRESQL_INITSCRIPTS_PASSWORD` | Password for the PostgreSQL init scripts user | `$POSTGRESQL_PASSWORD` | -| `POSTGRESQL_ENABLE_TLS` | Whether to enable TLS for traffic or not | `no` | -| `POSTGRESQL_TLS_CERT_FILE` | File containing the certificate for the TLS traffic | `nil` | -| `POSTGRESQL_TLS_KEY_FILE` | File containing the key for certificate | `nil` | -| `POSTGRESQL_TLS_CA_FILE` | File containing the CA of the certificate | `nil` | -| `POSTGRESQL_TLS_CRL_FILE` | File containing a Certificate Revocation List | `nil` | -| `POSTGRESQL_TLS_PREFER_SERVER_CIPHERS` | Whether to use the server TLS cipher preferences rather than the client | `yes` | -| `POSTGRESQL_SHARED_PRELOAD_LIBRARIES` | List of libraries to preload at PostgreSQL initialization | `pgaudit` | -| `POSTGRESQL_PGAUDIT_LOG` | Comma-separated list of actions to log with pgaudit | `nil` | -| `POSTGRESQL_PGAUDIT_LOG_CATALOG` | Enable pgaudit log catalog (pgaudit.log_catalog setting) | `nil` | -| `POSTGRESQL_PGAUDIT_LOG_PARAMETER` | Enable pgaudit log parameter (pgaudit.log_parameter setting) | `nil` | -| `POSTGRESQL_LOG_CONNECTIONS` | Add a log entry per user connection | `nil` | -| `POSTGRESQL_LOG_DISCONNECTIONS` | Add a log entry per user disconnection | `nil` | -| `POSTGRESQL_LOG_HOSTNAME` | Log the client host name when accessing | `nil` | -| `POSTGRESQL_CLIENT_MIN_MESSAGES` | Set log level of errors to send to the client | `error` | -| `POSTGRESQL_LOG_LINE_PREFIX` | Set the format of the log lines | `nil` | -| `POSTGRESQL_LOG_TIMEZONE` | Set the log timezone | `nil` | -| `POSTGRESQL_TIMEZONE` | Set the timezone | `nil` | -| `POSTGRESQL_MAX_CONNECTIONS` | Set the maximum amount of connections | `nil` | -| `POSTGRESQL_TCP_KEEPALIVES_IDLE` | Set the TCP keepalive idle time | `nil` | -| `POSTGRESQL_TCP_KEEPALIVES_INTERVAL` | Set the TCP keepalive interval time | `nil` | -| `POSTGRESQL_TCP_KEEPALIVES_COUNT` | Set the TCP keepalive count | `nil` | -| `POSTGRESQL_STATEMENT_TIMEOUT` | Set the SQL statement timeout | `nil` | -| `POSTGRESQL_PGHBA_REMOVE_FILTERS` | Comma-separated list of strings for removing pg_hba.conf lines (example: md5, local) | `nil` | -| `POSTGRESQL_USERNAME_CONNECTION_LIMIT` | Set the user connection limit | `nil` | -| `POSTGRESQL_POSTGRES_CONNECTION_LIMIT` | Set the postgres user connection limit | `nil` | -| `POSTGRESQL_WAL_LEVEL` | Set the write-ahead log level | `replica` | -| `POSTGRESQL_DEFAULT_TOAST_COMPRESSION` | Set the postgres default compression | `nil` | -| `POSTGRESQL_PASSWORD_ENCRYPTION` | Set the passwords encryption method | `nil` | -| `POSTGRESQL_DEFAULT_TRANSACTION_ISOLATION` | Set transaction isolation | `nil` | -| `POSTGRESQL_REPLICATION_NODES` | Override value for synchronous_standby_names in postgresql.conf. Should be set if `REPMGR_NODE_NAME` | `nil` | -| `POSTGRESQL_PERFORM_RESTORE` | Flag to skip deletion of `recovery.signal` file to enable native recovery. e.g by using `wal-g` | `no` | -| `POSTGRESQL_AUTOCTL_CONF_DIR` | Path to the configuration dir for the pg_autoctl command | `${POSTGRESQL_AUTOCTL_VOLUME_DIR}/.config` | -| `POSTGRESQL_AUTOCTL_MODE` | pgAutoFailover node type, valid values [monitor, postgres] | `postgres` | -| `POSTGRESQL_AUTOCTL_MONITOR_HOST` | Hostname for the monitor component | `monitor` | -| `POSTGRESQL_AUTOCTL_HOSTNAME` | Hostname by which postgres is reachable | `$(hostname --fqdn)` | -| `REPMGR_DATA_DIR` | Replication Manager data directory | `${REPMGR_VOLUME_DIR}/repmgr/data` | -| `REPMGR_SKIP_SETUP` | Skip Replication manager (and PostgreSQL) setup. | `no` | -| `REPMGR_NODE_ID` | Replication Manager node identifier | `nil` | -| `REPMGR_NODE_ID_START_SEED` | Replication Manager node identifier start seed | `1000` | -| `REPMGR_NODE_NAME` | Replication Manager node name | `$(hostname)` | -| `REPMGR_NODE_NETWORK_NAME` | Replication Manager node network name | `nil` | -| `REPMGR_NODE_PRIORITY` | Replication Manager node priority | `100` | -| `REPMGR_NODE_LOCATION` | Replication Manager node location | `default` | -| `REPMGR_NODE_TYPE` | Replication Manager node type | `data` | -| `REPMGR_PORT_NUMBER` | Replication Manager port number | `5432` | -| `REPMGR_LOG_LEVEL` | Replication Manager logging level | `NOTICE` | -| `REPMGR_USE_PGREWIND` | (Experimental) Use pg_rewind to synchronize from primary node | `no` | -| `REPMGR_START_OPTIONS` | Options to add when starting the node | `nil` | -| `REPMGR_CONNECT_TIMEOUT` | Replication Manager node connection timeout (in seconds) | `5` | -| `REPMGR_RECONNECT_ATTEMPTS` | Number of attempts to connect to the cluster before failing | `3` | -| `REPMGR_RECONNECT_INTERVAL` | Replication Manager node reconnect interval (in seconds) | `5` | -| `REPMGR_PARTNER_NODES` | List of other Replication Manager nodes in the cluster | `nil` | -| `REPMGR_PRIMARY_HOST` | Replication Manager cluster primary node | `nil` | -| `REPMGR_PRIMARY_PORT` | Replication Manager cluster primary node port | `5432` | -| `REPMGR_USE_REPLICATION_SLOTS` | Replication Manager replication slots | `1` | -| `REPMGR_MASTER_RESPONSE_TIMEOUT` | Time (in seconds) to wait for the master to reply | `20` | -| `REPMGR_PRIMARY_VISIBILITY_CONSENSUS` | Replication Manager flag to enable consult each other to build a quorum | `false` | -| `REPMGR_MONITORING_HISTORY` | Replication Manager flag to enable monitoring history | `no` | -| `REPMGR_MONITOR_INTERVAL_SECS` | Replication Manager interval at which to write monitoring data | `2` | -| `REPMGR_DEGRADED_MONITORING_TIMEOUT` | Replication Manager degraded monitoring timeout | `5` | -| `REPMGR_UPGRADE_EXTENSION` | Replication Manager upgrade extension | `no` | -| `REPMGR_FENCE_OLD_PRIMARY` | Replication Manager fence old primary | `no` | -| `REPMGR_FAILOVER` | Replication failover mode | `automatic` | -| `REPMGR_CHILD_NODES_CHECK_INTERVAL` | Replication Manager time interval to check nodes | `5` | -| `REPMGR_CHILD_NODES_CONNECTED_MIN_COUNT` | Replication Manager minimal connected nodes | `1` | -| `REPMGR_CHILD_NODES_DISCONNECT_TIMEOUT` | Replication Manager disconnected nodes timeout | `30` | -| `REPMGR_SWITCH_ROLE` | Flag to switch current node role | `no` | -| `REPMGR_CURRENT_PRIMARY_HOST` | Current primary host | `nil` | -| `REPMGR_USERNAME` | Replication manager username | `repmgr` | -| `REPMGR_DATABASE` | Replication manager database | `repmgr` | -| `REPMGR_PGHBA_TRUST_ALL` | Add trust all in Replication Manager pg_hba.conf | `no` | -| `REPMGR_PASSWORD` | Replication manager password | `nil` | -| `REPMGR_USE_PASSFILE` | Use PGPASSFILE instead of PGPASSWORD | `nil` | -| `REPMGR_PASSFILE_PATH` | Path to store passfile | `$REPMGR_CONF_DIR/.pgpass` | -| `PGCONNECT_TIMEOUT` | PostgreSQL connection timeout | `10` | +| Name | Description | Default Value | +|--------------------------------------------|------------------------------------------------------------------------------------------------------|-----------------------------------------| +| `POSTGRESQL_VOLUME_DIR` | Persistence base directory | `/bitnami/postgresql` | +| `POSTGRESQL_DATA_DIR` | PostgreSQL data directory | `${POSTGRESQL_VOLUME_DIR}/data` | +| `POSTGRESQL_EXTRA_FLAGS` | Extra flags for PostgreSQL initialization | `nil` | +| `POSTGRESQL_INIT_MAX_TIMEOUT` | Maximum initialization waiting timeout | `60` | +| `POSTGRESQL_PGCTLTIMEOUT` | Maximum waiting timeout for pg_ctl commands | `60` | +| `POSTGRESQL_SHUTDOWN_MODE` | Default mode for pg_ctl stop command | `fast` | +| `POSTGRESQL_CLUSTER_APP_NAME` | Replication cluster default application name | `walreceiver` | +| `POSTGRESQL_DATABASE` | Default PostgreSQL database | `postgres` | +| `POSTGRESQL_INITDB_ARGS` | Optional args for PostreSQL initdb operation | `nil` | +| `ALLOW_EMPTY_PASSWORD` | Allow password-less access | `no` | +| `POSTGRESQL_INITDB_WAL_DIR` | Optional init db wal directory | `nil` | +| `POSTGRESQL_MASTER_HOST` | PostgreSQL master host (used by slaves) | `nil` | +| `POSTGRESQL_MASTER_PORT_NUMBER` | PostgreSQL master host port (used by slaves) | `5432` | +| `POSTGRESQL_NUM_SYNCHRONOUS_REPLICAS` | Number of PostgreSQL replicas that should use synchronous replication | `0` | +| `POSTGRESQL_SYNCHRONOUS_REPLICAS_MODE` | PostgreSQL synchronous replication mode (values: empty, FIRST, ANY) | `nil` | +| `POSTGRESQL_PORT_NUMBER` | PostgreSQL port number | `5432` | +| `POSTGRESQL_ALLOW_REMOTE_CONNECTIONS` | Modify pg_hba settings so users can access from the outside | `yes` | +| `POSTGRESQL_REPLICATION_MODE` | PostgreSQL replication mode (values: master, slave) | `master` | +| `POSTGRESQL_REPLICATION_USER` | PostgreSQL replication user | `nil` | +| `POSTGRESQL_REPLICATION_USE_PASSFILE` | Use PGPASSFILE instead of PGPASSWORD | `yes` | +| `POSTGRESQL_REPLICATION_PASSFILE_PATH` | Path to store passfile | `${POSTGRESQL_CONF_DIR}/.pgpass` | +| `POSTGRESQL_SR_CHECK` | Create user on PostgreSQL for Stream Replication Check | `no` | +| `POSTGRESQL_SR_CHECK_USERNAME` | Stream Replication Check user | `sr_check_user` | +| `POSTGRESQL_SR_CHECK_DATABASE` | Stream Replication Check database | `postgres` | +| `POSTGRESQL_SYNCHRONOUS_COMMIT_MODE` | Enable synchronous replication in slaves (number defined by POSTGRESQL_NUM_SYNCHRONOUS_REPLICAS) | `on` | +| `POSTGRESQL_FSYNC` | Enable fsync in write ahead logs | `on` | +| `POSTGRESQL_USERNAME` | PostgreSQL default username | `postgres` | +| `POSTGRESQL_ENABLE_LDAP` | Enable LDAP for PostgreSQL authentication | `no` | +| `POSTGRESQL_LDAP_URL` | PostgreSQL LDAP server url (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | +| `POSTGRESQL_LDAP_PREFIX` | PostgreSQL LDAP prefix (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | +| `POSTGRESQL_LDAP_SUFFIX` | PostgreSQL LDAP suffix (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | +| `POSTGRESQL_LDAP_SERVER` | PostgreSQL LDAP server (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | +| `POSTGRESQL_LDAP_PORT` | PostgreSQL LDAP port (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | +| `POSTGRESQL_LDAP_SCHEME` | PostgreSQL LDAP scheme (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | +| `POSTGRESQL_LDAP_TLS` | PostgreSQL LDAP tls setting (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | +| `POSTGRESQL_LDAP_BASE_DN` | PostgreSQL LDAP base DN settings (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | +| `POSTGRESQL_LDAP_BIND_DN` | PostgreSQL LDAP bind DN settings (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | +| `POSTGRESQL_LDAP_BIND_PASSWORD` | PostgreSQL LDAP bind password (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | +| `POSTGRESQL_LDAP_BIND_USE_PASSFILE` | Use a passfile for LDAP bind password | `yes` | +| `POSTGRESQL_LDAP_BIND_PASSFILE_PATH` | Path to store LDAP bind password passfile | `${POSTGRESQL_CONF_DIR}/.ldap_bindpass` | +| `POSTGRESQL_LDAP_SEARCH_ATTR` | PostgreSQL LDAP search attribute (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | +| `POSTGRESQL_LDAP_SEARCH_FILTER` | PostgreSQL LDAP search filter (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | +| `POSTGRESQL_INITSCRIPTS_USERNAME` | Username for the psql scripts included in /docker-entrypoint.initdb | `$POSTGRESQL_USERNAME` | +| `POSTGRESQL_PASSWORD` | Password for the PostgreSQL created user | `nil` | +| `POSTGRESQL_POSTGRES_PASSWORD` | Password for the PostgreSQL postgres user | `nil` | +| `POSTGRESQL_REPLICATION_PASSWORD` | Password for the PostgreSQL replication user | `nil` | +| `POSTGRESQL_SR_CHECK_PASSWORD` | Password for the Stream Replication Check user | `nil` | +| `POSTGRESQL_INITSCRIPTS_PASSWORD` | Password for the PostgreSQL init scripts user | `$POSTGRESQL_PASSWORD` | +| `POSTGRESQL_ENABLE_TLS` | Whether to enable TLS for traffic or not | `no` | +| `POSTGRESQL_TLS_CERT_FILE` | File containing the certificate for the TLS traffic | `nil` | +| `POSTGRESQL_TLS_KEY_FILE` | File containing the key for certificate | `nil` | +| `POSTGRESQL_TLS_CA_FILE` | File containing the CA of the certificate | `nil` | +| `POSTGRESQL_TLS_CRL_FILE` | File containing a Certificate Revocation List | `nil` | +| `POSTGRESQL_TLS_PREFER_SERVER_CIPHERS` | Whether to use the server TLS cipher preferences rather than the client | `yes` | +| `POSTGRESQL_SHARED_PRELOAD_LIBRARIES` | List of libraries to preload at PostgreSQL initialization | `pgaudit` | +| `POSTGRESQL_PGAUDIT_LOG` | Comma-separated list of actions to log with pgaudit | `nil` | +| `POSTGRESQL_PGAUDIT_LOG_CATALOG` | Enable pgaudit log catalog (pgaudit.log_catalog setting) | `nil` | +| `POSTGRESQL_PGAUDIT_LOG_PARAMETER` | Enable pgaudit log parameter (pgaudit.log_parameter setting) | `nil` | +| `POSTGRESQL_LOG_CONNECTIONS` | Add a log entry per user connection | `nil` | +| `POSTGRESQL_LOG_DISCONNECTIONS` | Add a log entry per user disconnection | `nil` | +| `POSTGRESQL_LOG_HOSTNAME` | Log the client host name when accessing | `nil` | +| `POSTGRESQL_CLIENT_MIN_MESSAGES` | Set log level of errors to send to the client | `error` | +| `POSTGRESQL_LOG_LINE_PREFIX` | Set the format of the log lines | `nil` | +| `POSTGRESQL_LOG_TIMEZONE` | Set the log timezone | `nil` | +| `POSTGRESQL_TIMEZONE` | Set the timezone | `nil` | +| `POSTGRESQL_MAX_CONNECTIONS` | Set the maximum amount of connections | `nil` | +| `POSTGRESQL_TCP_KEEPALIVES_IDLE` | Set the TCP keepalive idle time | `nil` | +| `POSTGRESQL_TCP_KEEPALIVES_INTERVAL` | Set the TCP keepalive interval time | `nil` | +| `POSTGRESQL_TCP_KEEPALIVES_COUNT` | Set the TCP keepalive count | `nil` | +| `POSTGRESQL_STATEMENT_TIMEOUT` | Set the SQL statement timeout | `nil` | +| `POSTGRESQL_PGHBA_AUTH_METHOD` | Auth method to use for pg_hba.conf | `md5` | +| `POSTGRESQL_PGHBA_REMOVE_FILTERS` | Comma-separated list of strings for removing pg_hba.conf lines (example: md5, local) | `nil` | +| `POSTGRESQL_USERNAME_CONNECTION_LIMIT` | Set the user connection limit | `nil` | +| `POSTGRESQL_POSTGRES_CONNECTION_LIMIT` | Set the postgres user connection limit | `nil` | +| `POSTGRESQL_WAL_LEVEL` | Set the write-ahead log level | `replica` | +| `POSTGRESQL_DEFAULT_TOAST_COMPRESSION` | Set the postgres default compression | `nil` | +| `POSTGRESQL_PASSWORD_ENCRYPTION` | Set the passwords encryption method | `nil` | +| `POSTGRESQL_DEFAULT_TRANSACTION_ISOLATION` | Set transaction isolation | `nil` | +| `POSTGRESQL_REPLICATION_NODES` | Override value for synchronous_standby_names in postgresql.conf. Should be set if `REPMGR_NODE_NAME` | `nil` | +| `POSTGRESQL_PERFORM_RESTORE` | Flag to skip deletion of `recovery.signal` file to enable native recovery. e.g by using `wal-g` | `no` | +| `REPMGR_DATA_DIR` | Replication Manager data directory | `${REPMGR_VOLUME_DIR}/repmgr/data` | +| `REPMGR_SKIP_SETUP` | Skip Replication manager (and PostgreSQL) setup. | `no` | +| `REPMGR_NODE_ID` | Replication Manager node identifier | `nil` | +| `REPMGR_NODE_ID_START_SEED` | Replication Manager node identifier start seed | `1000` | +| `REPMGR_NODE_NAME` | Replication Manager node name | `$(hostname)` | +| `REPMGR_NODE_NETWORK_NAME` | Replication Manager node network name | `nil` | +| `REPMGR_NODE_PRIORITY` | Replication Manager node priority | `100` | +| `REPMGR_NODE_LOCATION` | Replication Manager node location | `default` | +| `REPMGR_NODE_TYPE` | Replication Manager node type | `data` | +| `REPMGR_PORT_NUMBER` | Replication Manager port number | `5432` | +| `REPMGR_LOG_LEVEL` | Replication Manager logging level | `NOTICE` | +| `REPMGR_USE_PGREWIND` | (Experimental) Use pg_rewind to synchronize from primary node | `no` | +| `REPMGR_START_OPTIONS` | Options to add when starting the node | `nil` | +| `REPMGR_CONNECT_TIMEOUT` | Replication Manager node connection timeout (in seconds) | `5` | +| `REPMGR_RECONNECT_ATTEMPTS` | Number of attempts to connect to the cluster before failing | `3` | +| `REPMGR_RECONNECT_INTERVAL` | Replication Manager node reconnect interval (in seconds) | `5` | +| `REPMGR_PARTNER_NODES` | List of other Replication Manager nodes in the cluster | `nil` | +| `REPMGR_PRIMARY_HOST` | Replication Manager cluster primary node | `nil` | +| `REPMGR_PRIMARY_PORT` | Replication Manager cluster primary node port | `5432` | +| `REPMGR_USE_REPLICATION_SLOTS` | Replication Manager replication slots | `1` | +| `REPMGR_MASTER_RESPONSE_TIMEOUT` | Time (in seconds) to wait for the master to reply | `20` | +| `REPMGR_PRIMARY_VISIBILITY_CONSENSUS` | Replication Manager flag to enable consult each other to build a quorum | `false` | +| `REPMGR_MONITORING_HISTORY` | Replication Manager flag to enable monitoring history | `no` | +| `REPMGR_MONITOR_INTERVAL_SECS` | Replication Manager interval at which to write monitoring data | `2` | +| `REPMGR_DEGRADED_MONITORING_TIMEOUT` | Replication Manager degraded monitoring timeout | `5` | +| `REPMGR_UPGRADE_EXTENSION` | Replication Manager upgrade extension | `no` | +| `REPMGR_FENCE_OLD_PRIMARY` | Replication Manager fence old primary | `no` | +| `REPMGR_FAILOVER` | Replication failover mode | `automatic` | +| `REPMGR_CHILD_NODES_CHECK_INTERVAL` | Replication Manager time interval to check nodes | `5` | +| `REPMGR_CHILD_NODES_CONNECTED_MIN_COUNT` | Replication Manager minimal connected nodes | `1` | +| `REPMGR_CHILD_NODES_DISCONNECT_TIMEOUT` | Replication Manager disconnected nodes timeout | `30` | +| `REPMGR_SSH_OPTIONS` | Replication Manager SSH options | `-o StrictHostKeyChecking=accept-new` | +| `REPMGR_SWITCH_ROLE` | Flag to switch current node role | `no` | +| `REPMGR_CURRENT_PRIMARY_HOST` | Current primary host | `nil` | +| `REPMGR_USERNAME` | Replication manager username | `repmgr` | +| `REPMGR_DATABASE` | Replication manager database | `repmgr` | +| `REPMGR_PGHBA_TRUST_ALL` | Add trust all in Replication Manager pg_hba.conf | `no` | +| `REPMGR_PASSWORD` | Replication manager password | `nil` | +| `REPMGR_USE_PASSFILE` | Use PGPASSFILE instead of PGPASSWORD | `yes` | +| `REPMGR_PASSFILE_PATH` | Path to store passfile | `$REPMGR_CONF_DIR/.pgpass` | +| `PGCONNECT_TIMEOUT` | PostgreSQL connection timeout | `10` | #### Read-only environment variables @@ -223,7 +223,6 @@ The following tables list the main variables you can set. | `POSTGRESQL_DAEMON_USER` | PostgreSQL system user | `postgres` | | `POSTGRESQL_DAEMON_GROUP` | PostgreSQL system group | `postgres` | | `POSTGRESQL_USE_CUSTOM_PGHBA_INITIALIZATION` | Initialize PostgreSQL with the custom, mounted pg_hba.conf file | `no` | -| `POSTGRESQL_AUTOCTL_VOLUME_DIR` | The pg_autoctl home directory | `${POSTGRESQL_VOLUME_DIR}/pgautoctl` | | `POSTGRESQL_PGBACKREST_VOLUME_DIR` | The pgbackrest home directory | `${POSTGRESQL_VOLUME_DIR}/pgbackrest` | | `POSTGRESQL_PGBACKREST_LOGS_DIR` | The pgbackrest logs directory | `${POSTGRESQL_PGBACKREST_VOLUME_DIR}/logs` | | `POSTGRESQL_PGBACKREST_BACKUPS_DIR` | The pgbackrest backups directory | `${POSTGRESQL_PGBACKREST_VOLUME_DIR}/backups` |