From 9725b10a6e452a4e2e4c7cd0bae887b92b30ff83 Mon Sep 17 00:00:00 2001 From: Bitnami Bot Date: Wed, 27 May 2026 15:28:36 +0200 Subject: [PATCH] [bitnami/pgpool] Release 4.7.1-debian-12-r7 (#94025) Signed-off-by: Bitnami Bot --- bitnami/pgpool/4/debian-12/Dockerfile | 12 +- ....7.1-0-linux-amd64-debian-12.tar.gz.sha256 | 1 + ....7.1-0-linux-arm64-debian-12.tar.gz.sha256 | 1 + ....4.0-0-linux-amd64-debian-12.tar.gz.sha256 | 1 + ....4.0-0-linux-arm64-debian-12.tar.gz.sha256 | 1 + ....10-10-linux-amd64-debian-12.tar.gz.sha256 | 1 + ....10-10-linux-arm64-debian-12.tar.gz.sha256 | 1 + .../prebuildfs/opt/bitnami/scripts/libfile.sh | 37 ++++++ .../prebuildfs/opt/bitnami/scripts/libfs.sh | 24 +++- .../opt/bitnami/scripts/libldapclient.sh | 6 +- .../rootfs/opt/bitnami/scripts/libpgpool.sh | 22 ++-- .../rootfs/opt/bitnami/scripts/pgpool-env.sh | 2 +- bitnami/pgpool/README.md | 106 +++++++++--------- 13 files changed, 139 insertions(+), 76 deletions(-) create mode 100644 bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/checksums/pgpool-4.7.1-0-linux-amd64-debian-12.tar.gz.sha256 create mode 100644 bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/checksums/pgpool-4.7.1-0-linux-arm64-debian-12.tar.gz.sha256 create mode 100644 bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/checksums/postgresql-client-18.4.0-0-linux-amd64-debian-12.tar.gz.sha256 create mode 100644 bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/checksums/postgresql-client-18.4.0-0-linux-arm64-debian-12.tar.gz.sha256 create mode 100644 bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/checksums/wait-for-port-1.0.10-10-linux-amd64-debian-12.tar.gz.sha256 create mode 100644 bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/checksums/wait-for-port-1.0.10-10-linux-arm64-debian-12.tar.gz.sha256 diff --git a/bitnami/pgpool/4/debian-12/Dockerfile b/bitnami/pgpool/4/debian-12/Dockerfile index 44ec681d3b27..9ca8798624ea 100644 --- a/bitnami/pgpool/4/debian-12/Dockerfile +++ b/bitnami/pgpool/4/debian-12/Dockerfile @@ -7,7 +7,7 @@ ARG DOWNLOADS_URL="downloads.bitnami.com/files/stacksmith" ARG TARGETARCH LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \ - org.opencontainers.image.created="2026-05-23T10:16:20Z" \ + org.opencontainers.image.created="2026-05-27T13:18:34Z" \ org.opencontainers.image.description="Application packaged by Broadcom, Inc." \ org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/pgpool/README.md" \ org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/pgpool" \ @@ -35,12 +35,12 @@ RUN --mount=type=secret,id=downloads_url,env=SECRET_DOWNLOADS_URL \ for COMPONENT in "${COMPONENTS[@]}"; do \ if [ ! -f "${COMPONENT}.tar.gz" ]; then \ curl -SsLf "https://${DOWNLOADS_URL}/${COMPONENT}.tar.gz" -O ; \ - curl -SsLf "https://${DOWNLOADS_URL}/${COMPONENT}.tar.gz.sha256" -O ; \ fi ; \ - sha256sum -c "${COMPONENT}.tar.gz.sha256" ; \ + sha256sum -c "/opt/bitnami/checksums/${COMPONENT}.tar.gz.sha256" ; \ tar -zxf "${COMPONENT}.tar.gz" -C /opt/bitnami --strip-components=2 --no-same-owner ; \ - rm -rf "${COMPONENT}".tar.gz{,.sha256} ; \ - done + rm -rf "${COMPONENT}".tar.gz ; \ + done ; \ + rm -rf /opt/bitnami/checksums ; RUN apt-get update && apt-get upgrade -y && \ apt-get clean && rm -rf /var/lib/apt/lists /var/cache/apt/archives RUN chmod g+rwX /opt/bitnami @@ -51,7 +51,7 @@ COPY rootfs / RUN /opt/bitnami/scripts/pgpool/postunpack.sh ENV APP_VERSION="4.7.1" \ BITNAMI_APP_NAME="pgpool" \ - IMAGE_REVISION="6" \ + IMAGE_REVISION="7" \ LD_LIBRARY_PATH="/opt/bitnami/common/lib:/opt/bitnami/common/lib64:/opt/bitnami/postgresql/lib:$LD_LIBRARY_PATH" \ PATH="/opt/bitnami/common/bin:/opt/bitnami/postgresql/bin:/opt/bitnami/pgpool/bin:/opt/bitnami/common/sbin:$PATH" diff --git a/bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/checksums/pgpool-4.7.1-0-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/checksums/pgpool-4.7.1-0-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..0d229933366c --- /dev/null +++ b/bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/checksums/pgpool-4.7.1-0-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +15375ddc403819c790ba804f86e7474091d0bf5bc3917b3a752ae30c47fe53d6 pgpool-4.7.1-0-linux-amd64-debian-12.tar.gz diff --git a/bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/checksums/pgpool-4.7.1-0-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/checksums/pgpool-4.7.1-0-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..d98f9e3462be --- /dev/null +++ b/bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/checksums/pgpool-4.7.1-0-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +74462e1c36d0b386eeebf7854ed21c05830e4d22188593ba242e33c7b51c9f6e pgpool-4.7.1-0-linux-arm64-debian-12.tar.gz diff --git a/bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/checksums/postgresql-client-18.4.0-0-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/checksums/postgresql-client-18.4.0-0-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..b7ca2505b7c2 --- /dev/null +++ b/bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/checksums/postgresql-client-18.4.0-0-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +94f47dda1a262952f801352ae6ba0c640a279384451c50d5bdfd354af008d76e postgresql-client-18.4.0-0-linux-amd64-debian-12.tar.gz diff --git a/bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/checksums/postgresql-client-18.4.0-0-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/checksums/postgresql-client-18.4.0-0-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..9017a72f7b84 --- /dev/null +++ b/bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/checksums/postgresql-client-18.4.0-0-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +b54111e298a44eacf4e41b1651c196d8aecd16f6b75b89c4a85c5e7f1a31bf26 postgresql-client-18.4.0-0-linux-arm64-debian-12.tar.gz diff --git a/bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/checksums/wait-for-port-1.0.10-10-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/checksums/wait-for-port-1.0.10-10-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..c96cae9e8074 --- /dev/null +++ b/bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/checksums/wait-for-port-1.0.10-10-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +4af7eb9cb9f027f08bd67ead26a6585ac71810c7dc396a453df794235e3476b3 wait-for-port-1.0.10-10-linux-amd64-debian-12.tar.gz diff --git a/bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/checksums/wait-for-port-1.0.10-10-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/checksums/wait-for-port-1.0.10-10-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..aebeba63fd0f --- /dev/null +++ b/bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/checksums/wait-for-port-1.0.10-10-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +72c721c238602c257e3f933797f266358032e3d2267c4f99707a33de5ee2038e wait-for-port-1.0.10-10-linux-arm64-debian-12.tar.gz diff --git a/bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh b/bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh index 1c69e0e48a5d..335c1c7c9ef7 100644 --- a/bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh +++ b/bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh @@ -139,3 +139,40 @@ wait_for_log_entry() { return 1 fi } + +######################## +# Creates a secure temporary file containing the provided secret +# Arguments: +# $1 - secret to write to the temporary file +# Returns: +# String +######################### +credential_to_temp_file() { + local secret="$1" + local tmp_file + + # Use mktemp with a specific prefix for easier debugging if something lingers + if ! tmp_file=$(mktemp "${TMPDIR:-/tmp}/at.cred.XXXXXXXX"); then + echo "Error: Failed to create temp file" >&2 + return 1 + fi + + # Restrict permissions before writing the secret + chmod 0600 "$tmp_file" + # Write secret and ensure it's flushed to disk + printf "%s" "$secret" > "$tmp_file" + # Output the filename so the caller can capture it + echo "$tmp_file" +} + +######################## +# Cleans up temporary files created by credential_to_temp_file +# Arguments: +# None +# Returns: +# None +######################### +cleanup_credentials() { + debug "Cleaning up temporary files containing credentials" + rm -rf "${TMPDIR:-/tmp}"/at.cred.* +} diff --git a/bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh b/bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh index 1337f6c2dd59..b16efabd3230 100644 --- a/bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh +++ b/bitnami/pgpool/4/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh @@ -131,6 +131,7 @@ relativize() { # -d|--dir-mode - mode for files. # -u|--user - user # -g|--group - group +# -n|--no-dereference - do not follow symlinks (use for runtime root chown of daemon-writable dirs) # Returns: # None ######################### @@ -140,6 +141,7 @@ configure_permissions_ownership() { local file_mode="" local user="" local group="" + local follow_symlinks="yes" # Validate arguments shift 1 @@ -161,6 +163,9 @@ configure_permissions_ownership() { shift group="${1:?missing group}" ;; + -n | --no-dereference) + follow_symlinks="no" + ;; *) echo "Invalid command line flag $1" >&2 return 1 @@ -169,22 +174,29 @@ configure_permissions_ownership() { shift done + # -L: follow symlinks and emits the target path + # This is dangerous at runtime, given a co-located lower-privileged process with write access + # to the target path can redirect the chown/chmod to arbitrary paths. Example: + # Lower-privileged process run: ln -s /etc /tmp/etc + # Then, setup.sh runs: configure_permissions_ownership --dir-mode 775 /tmp + local find_L_flag=(); [[ "$follow_symlinks" == "yes" ]] && find_L_flag=("-L") + # -h: changes symlink inode ownership without touching the target. + local chown_flags=(); [[ "$follow_symlinks" == "no" ]] && chown_flags=("-h") read -r -a filepaths <<<"$paths" for p in "${filepaths[@]}"; do if [[ -e "$p" ]]; then - find -L "$p" -printf "" if [[ -n $dir_mode ]]; then - find -L "$p" -type d ! -perm "$dir_mode" -print0 | xargs -r -0 chmod "$dir_mode" + find "${find_L_flag[@]}" "$p" -not -type l -type d ! -perm "$dir_mode" -print0 | xargs -r -0 chmod "$dir_mode" fi if [[ -n $file_mode ]]; then - find -L "$p" -type f ! -perm "$file_mode" -print0 | xargs -r -0 chmod "$file_mode" + find "${find_L_flag[@]}" "$p" -not -type l -type f ! -perm "$file_mode" -print0 | xargs -r -0 chmod "$file_mode" fi if [[ -n $user ]] && [[ -n $group ]]; then - find -L "$p" -print0 | xargs -r -0 chown "${user}:${group}" + find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chown "${chown_flags[@]}" "${user}:${group}" elif [[ -n $user ]] && [[ -z $group ]]; then - find -L "$p" -print0 | xargs -r -0 chown "${user}" + find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chown "${chown_flags[@]}" "${user}" elif [[ -z $user ]] && [[ -n $group ]]; then - find -L "$p" -print0 | xargs -r -0 chgrp "${group}" + find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chgrp "${chown_flags[@]}" "${group}" fi else stderr_print "$p does not exist" diff --git a/bitnami/pgpool/4/debian-12/rootfs/opt/bitnami/scripts/libldapclient.sh b/bitnami/pgpool/4/debian-12/rootfs/opt/bitnami/scripts/libldapclient.sh index 82a155d37e9f..2561738807b2 100644 --- a/bitnami/pgpool/4/debian-12/rootfs/opt/bitnami/scripts/libldapclient.sh +++ b/bitnami/pgpool/4/debian-12/rootfs/opt/bitnami/scripts/libldapclient.sh @@ -75,11 +75,11 @@ ldap_openldap_config_path() { # None ######################### ldap_configure_permissions() { - ensure_dir_exists "/var/run/nslcd" && configure_permissions_ownership "/var/run/nslcd" -u "root" -g "root" -d "775" + ensure_dir_exists "/var/run/nslcd" && configure_permissions_ownership "/var/run/nslcd" -u "root" -g "root" -d "775" -n # The nslcd.conf file may not exist in distros like UBI, so we need to create it first touch "/etc/nslcd.conf" - configure_permissions_ownership "/etc/nslcd.conf" -u "root" -g "root" -f "660" - configure_permissions_ownership "$(ldap_openldap_config_path)" -u "root" -g "root" -f "660" + configure_permissions_ownership "/etc/nslcd.conf" -u "root" -g "root" -f "660" -n + configure_permissions_ownership "$(ldap_openldap_config_path)" -u "root" -g "root" -f "660" -n } ######################## diff --git a/bitnami/pgpool/4/debian-12/rootfs/opt/bitnami/scripts/libpgpool.sh b/bitnami/pgpool/4/debian-12/rootfs/opt/bitnami/scripts/libpgpool.sh index f7d2368a1c1d..f0ae7ec8ac0e 100644 --- a/bitnami/pgpool/4/debian-12/rootfs/opt/bitnami/scripts/libpgpool.sh +++ b/bitnami/pgpool/4/debian-12/rootfs/opt/bitnami/scripts/libpgpool.sh @@ -509,9 +509,13 @@ pgpool_generate_password_file() { if is_boolean_yes "$PGPOOL_ENABLE_POOL_PASSWD"; then info "Generating password file for local authentication..." - debug_execute pgpool_encrypt_execute -m --config-file="$PGPOOL_CONF_FILE" -u "$PGPOOL_POSTGRES_USERNAME" "$PGPOOL_POSTGRES_PASSWORD" + local postgres_password_file + postgres_password_file="$(credential_to_temp_file "$PGPOOL_POSTGRES_PASSWORD")" + debug_execute pgpool_encrypt_execute -m --config-file="$PGPOOL_CONF_FILE" -u "$PGPOOL_POSTGRES_USERNAME" "$(<"$postgres_password_file")" if [[ -n "$PGPOOL_SR_CHECK_USER" ]]; then - debug_execute pgpool_encrypt_execute -m --config-file="$PGPOOL_CONF_FILE" -u "$PGPOOL_SR_CHECK_USER" "$PGPOOL_SR_CHECK_PASSWORD" + local sr_check_password_file + sr_check_password_file="$(credential_to_temp_file "$PGPOOL_SR_CHECK_PASSWORD")" + debug_execute pgpool_encrypt_execute -m --config-file="$PGPOOL_CONF_FILE" -u "$PGPOOL_SR_CHECK_USER" "$(<"$sr_check_password_file")" fi if [[ -n "${PGPOOL_POSTGRES_CUSTOM_USERS}" ]]; then @@ -520,7 +524,9 @@ pgpool_generate_password_file() { local index=0 for user in "${custom_users_list[@]}"; do - debug_execute pgpool_encrypt_execute -m --config-file="$PGPOOL_CONF_FILE" -u "$user" "${custom_passwords_list[$index]}" + local custom_password_file + custom_password_file="$(credential_to_temp_file "${custom_passwords_list[$index]}")" + debug_execute pgpool_encrypt_execute -m --config-file="$PGPOOL_CONF_FILE" -u "$user" "$(<"$custom_password_file")" ((index += 1)) done fi @@ -541,10 +547,12 @@ pgpool_generate_password_file() { pgpool_encrypt_password() { local -r password="${1:?missing password}" + local password_file + password_file="$(credential_to_temp_file "$password")" if [[ "$PGPOOL_AUTHENTICATION_METHOD" =~ ^(scram-sha-256|trust)$ ]]; then - pgpool_encrypt_execute "$password" | grep -o -E "AES.+" | tr -d '\n' + pgpool_encrypt_execute "$(<"$password_file")" | grep -o -E "AES.+" | tr -d '\n' else - pgpool_encrypt_execute "$password" | tr -d '\n' + pgpool_encrypt_execute "$(<"$password_file")" | tr -d '\n' fi } @@ -608,8 +616,8 @@ pgpool_initialize() { rm -f "$PGPOOL_PID_FILE" # Configuring permissions for tmp, logs and data folders - am_i_root && configure_permissions_ownership "$PGPOOL_TMP_DIR $PGPOOL_LOG_DIR" -u "$PGPOOL_DAEMON_USER" -g "$PGPOOL_DAEMON_GROUP" - am_i_root && configure_permissions_ownership "$PGPOOL_DATA_DIR" -u "$PGPOOL_DAEMON_USER" -g "$PGPOOL_DAEMON_GROUP" -d "755" -f "644" + am_i_root && configure_permissions_ownership "$PGPOOL_TMP_DIR $PGPOOL_LOG_DIR" -u "$PGPOOL_DAEMON_USER" -g "$PGPOOL_DAEMON_GROUP" -n + am_i_root && configure_permissions_ownership "$PGPOOL_DATA_DIR" -u "$PGPOOL_DAEMON_USER" -g "$PGPOOL_DAEMON_GROUP" -d "755" -f "644" -n pgpool_create_pghba pgpool_create_config diff --git a/bitnami/pgpool/4/debian-12/rootfs/opt/bitnami/scripts/pgpool-env.sh b/bitnami/pgpool/4/debian-12/rootfs/opt/bitnami/scripts/pgpool-env.sh index 04d7611ea676..0798e6d6fb7a 100644 --- a/bitnami/pgpool/4/debian-12/rootfs/opt/bitnami/scripts/pgpool-env.sh +++ b/bitnami/pgpool/4/debian-12/rootfs/opt/bitnami/scripts/pgpool-env.sh @@ -145,7 +145,7 @@ export PGPOOL_POSTGRES_CUSTOM_USERS="${PGPOOL_POSTGRES_CUSTOM_USERS:-}" export PGPOOL_POSTGRES_CUSTOM_PASSWORDS="${PGPOOL_POSTGRES_CUSTOM_PASSWORDS:-}" export PGPOOL_ENABLE_LDAP="${PGPOOL_ENABLE_LDAP:-no}" export PGPOOL_AUTHENTICATION_METHOD="${PGPOOL_AUTHENTICATION_METHOD:-scram-sha-256}" -export PGPOOL_AES_KEY="${PGPOOL_AES_KEY:-head -c 20 /dev/urandom | base64}" +export PGPOOL_AES_KEY="${PGPOOL_AES_KEY:-$(head -c 20 /dev/urandom | base64)}" # TLS settings export PGPOOL_ENABLE_TLS="${PGPOOL_ENABLE_TLS:-no}" diff --git a/bitnami/pgpool/README.md b/bitnami/pgpool/README.md index da0610051302..0b0cb4200b70 100644 --- a/bitnami/pgpool/README.md +++ b/bitnami/pgpool/README.md @@ -130,59 +130,59 @@ The following tables list the main variables you can set. #### Customizable environment variables -| Name | Description | Default Value | -|------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------| -| `PGPOOL_WORK_DIR` | Pgpool-II working directory. | `/tmp` | -| `PGPOOL_USER_CONF_FILE` | Custom Pgpool-II configuration file to be appended at Pgpool-II configuration file. | `nil` | -| `PGPOOL_USER_HBA_FILE` | Custom Pgpool-II host-based authentication configuration to be appended to Pgpool-II host-based authentication configuration file. | `nil` | -| `PGPOOL_PASSWD_FILE` | Pgpool-II pool password file. | `pool_passwd` | -| `PGPOOL_PORT_NUMBER` | Pgpool-II port number. | `5432` | -| `PGPOOL_ENABLE_POOL_HBA` | Enable Pgpool-II host-based authentication. | `yes` | -| `PGPOOL_ENABLE_POOL_PASSWD` | Enable Pgpool-II pool password. | `yes` | -| `PGPOOL_ENABLE_LOAD_BALANCING` | Enable Load-Balancing. | `yes` | -| `PGPOOL_ENABLE_STATEMENT_LOAD_BALANCING` | Enable Statement Load-Balancing. | `no` | -| `PGPOOL_DISABLE_LOAD_BALANCE_ON_WRITE` | Disable Load-Balancing on write queries. | `transaction` | -| `PGPOOL_ENABLE_CONNECTION_CACHE` | Enable Pgpool-II connection cache. | `yes` | -| `PGPOOL_TIMEOUT` | Pgpool-II timeout (in seconds). | `360` | -| `PGPOOL_CONNECT_TIMEOUT` | Pgpool-II connection timeout (in milliseconds). | `10000` | -| `PGPOOL_MAX_POOL` | Pgpool-II maximum number of cached connections. | `15` | -| `PGPOOL_HEALTH_CHECK_PERIOD` | Pgpool-II Health Check period (in seconds). | `30` | -| `PGPOOL_HEALTH_CHECK_TIMEOUT` | Pgpool-II Health Check timeout (in seconds). | `10` | -| `PGPOOL_HEALTH_CHECK_MAX_RETRIES` | Pgpool-II Health Check max retries. | `5` | -| `PGPOOL_HEALTH_CHECK_RETRY_DELAY` | Pgpool-II Health Check retry delay (in seconds). | `5` | -| `PGPOOL_HEALTH_CHECK_PSQL_TIMEOUT` | Pgpool-II Health Check psql timeout (in seconds). | `15` | -| `PGPOOL_AUTO_FAILBACK` | Enable Pgpool-II auto_failback on false primaries detection. | `no` | -| `PGPOOL_DISCARD_STATUS` | Discard Pgpool-II status file on restarts. | `yes` | -| `PGPOOL_SR_CHECK_USER` | Pgpool-II Streaming Replication Check username. | `nil` | -| `PGPOOL_SR_CHECK_PASSWORD` | Pgpool-II Streaming Replication Check password. | `nil` | -| `PGPOOL_SR_CHECK_DATABASE` | Pgpool-II Streaming Replication Check database. | `postgres` | -| `PGPOOL_SR_CHECK_PERIOD` | Pgpool-II Streaming Replication Check period (in seconds). | `30` | -| `PGPOOL_HEALTH_CHECK_USER` | Pgpool-II Health Check username. | `$PGPOOL_SR_CHECK_USER` | -| `PGPOOL_HEALTH_CHECK_PASSWORD` | Pgpool-II Health Check password. | `$PGPOOL_SR_CHECK_PASSWORD` | -| `PGPOOL_ADMIN_USERNAME` | Pgpool-II Admin username. | `nil` | -| `PGPOOL_ADMIN_PASSWORD` | Pgpool-II Admin password. | `nil` | -| `PGPOOL_POSTGRES_USERNAME` | PostgreSQL backend admin username. | `postgres` | -| `PGPOOL_POSTGRES_PASSWORD` | PostgreSQL backend admin password. | `nil` | -| `PGPOOL_POSTGRES_CUSTOM_USERS` | Comma, semi-colon or space separated list of custom users to create. | `nil` | -| `PGPOOL_POSTGRES_CUSTOM_PASSWORDS` | Comma, semi-colon or space separated list of passwords for the custom users to create. | `nil` | -| `PGPOOL_ENABLE_LDAP` | Enable LDAP on Pgpool-II. | `no` | -| `PGPOOL_AUTHENTICATION_METHOD` | Pgpool-II authentication method. | `scram-sha-256` | -| `PGPOOL_AES_KEY` | Pgpool-II AES key. | `head -c 20 /dev/urandom \| base64` | -| `PGPOOL_ENABLE_TLS` | Enable TLS on Pgpool-II. | `no` | -| `PGPOOL_TLS_CA_FILE` | Pgpool-II TLS authentication CA file. | `nil` | -| `PGPOOL_TLS_CERT_FILE` | Pgpool-II TLS authentication cert file. | `nil` | -| `PGPOOL_TLS_KEY_FILE` | Pgpool-II TLS authentication key file. | `nil` | -| `PGPOOL_TLS_PREFER_SERVER_CIPHERS` | Prefer server TLS authentication ciphers. | `yes` | -| `PGPOOL_ENABLE_LOG_CONNECTIONS` | Enable Pgpool-II log connections | `no` | -| `PGPOOL_ENABLE_LOG_HOSTNAME` | Show clients hostnames on Pgpool-II connections logs. | `no` | -| `PGPOOL_ENABLE_LOG_PCP_PROCESSES` | Enable PCP processes logging. | `yes` | -| `PGPOOL_ENABLE_LOG_PER_NODE_STATEMENT` | Enable logging every SQL statement for each DB node separately. | `no` | -| `PGPOOL_BACKEND_NODES` | Comma, semi-colon or space separated list of PostgreSQL backend nodes. | `nil` | -| `PGPOOL_BACKEND_APPLICATION_NAMES` | Comma, semi-colon or space separated list of PostgreSQL backend application names. | `nil` | -| `PGPOOL_FAILOVER_ON_BACKEND_SHUTDOWN` | Enable failover recovery on backend shutdown. | `on` | -| `PGPOOL_FAILOVER_ON_BACKEND_ERROR` | Enable failover recovery on backend error. | `off` | -| `PGPOOL_DAEMON_USER` | Pgpool-II daemon user | `pgpool` | -| `PGPOOL_DAEMON_GROUP` | Pgpool-II daemon group | `pgpool` | +| Name | Description | Default Value | +|------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------| +| `PGPOOL_WORK_DIR` | Pgpool-II working directory. | `/tmp` | +| `PGPOOL_USER_CONF_FILE` | Custom Pgpool-II configuration file to be appended at Pgpool-II configuration file. | `nil` | +| `PGPOOL_USER_HBA_FILE` | Custom Pgpool-II host-based authentication configuration to be appended to Pgpool-II host-based authentication configuration file. | `nil` | +| `PGPOOL_PASSWD_FILE` | Pgpool-II pool password file. | `pool_passwd` | +| `PGPOOL_PORT_NUMBER` | Pgpool-II port number. | `5432` | +| `PGPOOL_ENABLE_POOL_HBA` | Enable Pgpool-II host-based authentication. | `yes` | +| `PGPOOL_ENABLE_POOL_PASSWD` | Enable Pgpool-II pool password. | `yes` | +| `PGPOOL_ENABLE_LOAD_BALANCING` | Enable Load-Balancing. | `yes` | +| `PGPOOL_ENABLE_STATEMENT_LOAD_BALANCING` | Enable Statement Load-Balancing. | `no` | +| `PGPOOL_DISABLE_LOAD_BALANCE_ON_WRITE` | Disable Load-Balancing on write queries. | `transaction` | +| `PGPOOL_ENABLE_CONNECTION_CACHE` | Enable Pgpool-II connection cache. | `yes` | +| `PGPOOL_TIMEOUT` | Pgpool-II timeout (in seconds). | `360` | +| `PGPOOL_CONNECT_TIMEOUT` | Pgpool-II connection timeout (in milliseconds). | `10000` | +| `PGPOOL_MAX_POOL` | Pgpool-II maximum number of cached connections. | `15` | +| `PGPOOL_HEALTH_CHECK_PERIOD` | Pgpool-II Health Check period (in seconds). | `30` | +| `PGPOOL_HEALTH_CHECK_TIMEOUT` | Pgpool-II Health Check timeout (in seconds). | `10` | +| `PGPOOL_HEALTH_CHECK_MAX_RETRIES` | Pgpool-II Health Check max retries. | `5` | +| `PGPOOL_HEALTH_CHECK_RETRY_DELAY` | Pgpool-II Health Check retry delay (in seconds). | `5` | +| `PGPOOL_HEALTH_CHECK_PSQL_TIMEOUT` | Pgpool-II Health Check psql timeout (in seconds). | `15` | +| `PGPOOL_AUTO_FAILBACK` | Enable Pgpool-II auto_failback on false primaries detection. | `no` | +| `PGPOOL_DISCARD_STATUS` | Discard Pgpool-II status file on restarts. | `yes` | +| `PGPOOL_SR_CHECK_USER` | Pgpool-II Streaming Replication Check username. | `nil` | +| `PGPOOL_SR_CHECK_PASSWORD` | Pgpool-II Streaming Replication Check password. | `nil` | +| `PGPOOL_SR_CHECK_DATABASE` | Pgpool-II Streaming Replication Check database. | `postgres` | +| `PGPOOL_SR_CHECK_PERIOD` | Pgpool-II Streaming Replication Check period (in seconds). | `30` | +| `PGPOOL_HEALTH_CHECK_USER` | Pgpool-II Health Check username. | `$PGPOOL_SR_CHECK_USER` | +| `PGPOOL_HEALTH_CHECK_PASSWORD` | Pgpool-II Health Check password. | `$PGPOOL_SR_CHECK_PASSWORD` | +| `PGPOOL_ADMIN_USERNAME` | Pgpool-II Admin username. | `nil` | +| `PGPOOL_ADMIN_PASSWORD` | Pgpool-II Admin password. | `nil` | +| `PGPOOL_POSTGRES_USERNAME` | PostgreSQL backend admin username. | `postgres` | +| `PGPOOL_POSTGRES_PASSWORD` | PostgreSQL backend admin password. | `nil` | +| `PGPOOL_POSTGRES_CUSTOM_USERS` | Comma, semi-colon or space separated list of custom users to create. | `nil` | +| `PGPOOL_POSTGRES_CUSTOM_PASSWORDS` | Comma, semi-colon or space separated list of passwords for the custom users to create. | `nil` | +| `PGPOOL_ENABLE_LDAP` | Enable LDAP on Pgpool-II. | `no` | +| `PGPOOL_AUTHENTICATION_METHOD` | Pgpool-II authentication method. | `scram-sha-256` | +| `PGPOOL_AES_KEY` | Pgpool-II AES key. | `$(head -c 20 /dev/urandom \| base64)` | +| `PGPOOL_ENABLE_TLS` | Enable TLS on Pgpool-II. | `no` | +| `PGPOOL_TLS_CA_FILE` | Pgpool-II TLS authentication CA file. | `nil` | +| `PGPOOL_TLS_CERT_FILE` | Pgpool-II TLS authentication cert file. | `nil` | +| `PGPOOL_TLS_KEY_FILE` | Pgpool-II TLS authentication key file. | `nil` | +| `PGPOOL_TLS_PREFER_SERVER_CIPHERS` | Prefer server TLS authentication ciphers. | `yes` | +| `PGPOOL_ENABLE_LOG_CONNECTIONS` | Enable Pgpool-II log connections | `no` | +| `PGPOOL_ENABLE_LOG_HOSTNAME` | Show clients hostnames on Pgpool-II connections logs. | `no` | +| `PGPOOL_ENABLE_LOG_PCP_PROCESSES` | Enable PCP processes logging. | `yes` | +| `PGPOOL_ENABLE_LOG_PER_NODE_STATEMENT` | Enable logging every SQL statement for each DB node separately. | `no` | +| `PGPOOL_BACKEND_NODES` | Comma, semi-colon or space separated list of PostgreSQL backend nodes. | `nil` | +| `PGPOOL_BACKEND_APPLICATION_NAMES` | Comma, semi-colon or space separated list of PostgreSQL backend application names. | `nil` | +| `PGPOOL_FAILOVER_ON_BACKEND_SHUTDOWN` | Enable failover recovery on backend shutdown. | `on` | +| `PGPOOL_FAILOVER_ON_BACKEND_ERROR` | Enable failover recovery on backend error. | `off` | +| `PGPOOL_DAEMON_USER` | Pgpool-II daemon user | `pgpool` | +| `PGPOOL_DAEMON_GROUP` | Pgpool-II daemon group | `pgpool` | #### Read-only environment variables