From f3268f83f5d98e009c40238cb20eb4dd9c380647 Mon Sep 17 00:00:00 2001 From: Bitnami Bot Date: Thu, 28 May 2026 10:29:47 +0200 Subject: [PATCH] [bitnami/postgresql] Release 18.4.0-debian-12-r4 (#94043) Signed-off-by: Bitnami Bot --- bitnami/postgresql/18/debian-12/Dockerfile | 12 +- ...1.16-0-linux-amd64-debian-12.tar.gz.sha256 | 1 + ...1.16-0-linux-arm64-debian-12.tar.gz.sha256 | 1 + ....4.0-0-linux-amd64-debian-12.tar.gz.sha256 | 1 + ....4.0-0-linux-arm64-debian-12.tar.gz.sha256 | 1 + .../prebuildfs/opt/bitnami/scripts/libfile.sh | 37 +++ .../prebuildfs/opt/bitnami/scripts/libfs.sh | 24 +- .../rootfs/opt/bitnami/scripts/libautoctl.sh | 308 ------------------ .../opt/bitnami/scripts/libpostgresql.sh | 14 +- .../opt/bitnami/scripts/postgresql-env.sh | 17 +- .../bitnami/scripts/postgresql/run-autoctl.sh | 32 -- bitnami/postgresql/README.md | 165 +++++----- 12 files changed, 164 insertions(+), 449 deletions(-) create mode 100644 bitnami/postgresql/18/debian-12/prebuildfs/opt/bitnami/checksums/nss-wrapper-1.1.16-0-linux-amd64-debian-12.tar.gz.sha256 create mode 100644 bitnami/postgresql/18/debian-12/prebuildfs/opt/bitnami/checksums/nss-wrapper-1.1.16-0-linux-arm64-debian-12.tar.gz.sha256 create mode 100644 bitnami/postgresql/18/debian-12/prebuildfs/opt/bitnami/checksums/postgresql-18.4.0-0-linux-amd64-debian-12.tar.gz.sha256 create mode 100644 bitnami/postgresql/18/debian-12/prebuildfs/opt/bitnami/checksums/postgresql-18.4.0-0-linux-arm64-debian-12.tar.gz.sha256 delete mode 100644 bitnami/postgresql/18/debian-12/rootfs/opt/bitnami/scripts/libautoctl.sh delete mode 100755 bitnami/postgresql/18/debian-12/rootfs/opt/bitnami/scripts/postgresql/run-autoctl.sh diff --git a/bitnami/postgresql/18/debian-12/Dockerfile b/bitnami/postgresql/18/debian-12/Dockerfile index 41c8c663e3d0..8f610c6ed077 100644 --- a/bitnami/postgresql/18/debian-12/Dockerfile +++ b/bitnami/postgresql/18/debian-12/Dockerfile @@ -9,7 +9,7 @@ ARG TARGETARCH ARG WITH_ALL_LOCALES="no" LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \ - org.opencontainers.image.created="2026-05-23T10:43:25Z" \ + org.opencontainers.image.created="2026-05-28T08:14:10Z" \ org.opencontainers.image.description="Application packaged by Broadcom, Inc." \ org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/postgresql/README.md" \ org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/postgresql" \ @@ -36,12 +36,12 @@ RUN --mount=type=secret,id=downloads_url,env=SECRET_DOWNLOADS_URL \ for COMPONENT in "${COMPONENTS[@]}"; do \ if [ ! -f "${COMPONENT}.tar.gz" ]; then \ curl -SsLf "https://${DOWNLOADS_URL}/${COMPONENT}.tar.gz" -O ; \ - curl -SsLf "https://${DOWNLOADS_URL}/${COMPONENT}.tar.gz.sha256" -O ; \ fi ; \ - sha256sum -c "${COMPONENT}.tar.gz.sha256" ; \ + sha256sum -c "/opt/bitnami/checksums/${COMPONENT}.tar.gz.sha256" ; \ tar -zxf "${COMPONENT}.tar.gz" -C /opt/bitnami --strip-components=2 --no-same-owner ; \ - rm -rf "${COMPONENT}".tar.gz{,.sha256} ; \ - done + rm -rf "${COMPONENT}".tar.gz ; \ + done ; \ + rm -rf /opt/bitnami/checksums ; RUN apt-get update && apt-get upgrade -y && \ apt-get clean && rm -rf /var/lib/apt/lists /var/cache/apt/archives RUN chmod g+rwX /opt/bitnami @@ -56,7 +56,7 @@ COPY rootfs / RUN /opt/bitnami/scripts/postgresql/postunpack.sh ENV APP_VERSION="18.4.0" \ BITNAMI_APP_NAME="postgresql" \ - IMAGE_REVISION="3" \ + IMAGE_REVISION="4" \ LANG="en_US.UTF-8" \ LANGUAGE="en_US:en" \ NSS_WRAPPER_LIB="/opt/bitnami/common/lib/libnss_wrapper.so" \ diff --git a/bitnami/postgresql/18/debian-12/prebuildfs/opt/bitnami/checksums/nss-wrapper-1.1.16-0-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/postgresql/18/debian-12/prebuildfs/opt/bitnami/checksums/nss-wrapper-1.1.16-0-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..cf2734607b9e --- /dev/null +++ b/bitnami/postgresql/18/debian-12/prebuildfs/opt/bitnami/checksums/nss-wrapper-1.1.16-0-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +af31040a9ef21924a1d4c6d3f0bd6a6be9ef701c9e726b9b3997b82394779b6e nss-wrapper-1.1.16-0-linux-amd64-debian-12.tar.gz diff --git a/bitnami/postgresql/18/debian-12/prebuildfs/opt/bitnami/checksums/nss-wrapper-1.1.16-0-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/postgresql/18/debian-12/prebuildfs/opt/bitnami/checksums/nss-wrapper-1.1.16-0-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..c4594d6aa7c5 --- /dev/null +++ b/bitnami/postgresql/18/debian-12/prebuildfs/opt/bitnami/checksums/nss-wrapper-1.1.16-0-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +9315fee0fbce2e445778f4cddd4b5a9ae657d40bcc4c9534430d8eaeecf7307c nss-wrapper-1.1.16-0-linux-arm64-debian-12.tar.gz diff --git a/bitnami/postgresql/18/debian-12/prebuildfs/opt/bitnami/checksums/postgresql-18.4.0-0-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/postgresql/18/debian-12/prebuildfs/opt/bitnami/checksums/postgresql-18.4.0-0-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..d58cee23bc0c --- /dev/null +++ b/bitnami/postgresql/18/debian-12/prebuildfs/opt/bitnami/checksums/postgresql-18.4.0-0-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +86465726aaba288cf63c932a6ab166f5e7e3971ed9dba86c7ad5741ae168717a postgresql-18.4.0-0-linux-amd64-debian-12.tar.gz diff --git a/bitnami/postgresql/18/debian-12/prebuildfs/opt/bitnami/checksums/postgresql-18.4.0-0-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/postgresql/18/debian-12/prebuildfs/opt/bitnami/checksums/postgresql-18.4.0-0-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..a1744fd8031e --- /dev/null +++ b/bitnami/postgresql/18/debian-12/prebuildfs/opt/bitnami/checksums/postgresql-18.4.0-0-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +d2fbed3cf087e7f5a0ce2ab3f3b0a9f850e5d9abfb72299d75866b59cd1cd352 postgresql-18.4.0-0-linux-arm64-debian-12.tar.gz diff --git a/bitnami/postgresql/18/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh b/bitnami/postgresql/18/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh index 1c69e0e48a5d..335c1c7c9ef7 100644 --- a/bitnami/postgresql/18/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh +++ b/bitnami/postgresql/18/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh @@ -139,3 +139,40 @@ wait_for_log_entry() { return 1 fi } + +######################## +# Creates a secure temporary file containing the provided secret +# Arguments: +# $1 - secret to write to the temporary file +# Returns: +# String +######################### +credential_to_temp_file() { + local secret="$1" + local tmp_file + + # Use mktemp with a specific prefix for easier debugging if something lingers + if ! tmp_file=$(mktemp "${TMPDIR:-/tmp}/at.cred.XXXXXXXX"); then + echo "Error: Failed to create temp file" >&2 + return 1 + fi + + # Restrict permissions before writing the secret + chmod 0600 "$tmp_file" + # Write secret and ensure it's flushed to disk + printf "%s" "$secret" > "$tmp_file" + # Output the filename so the caller can capture it + echo "$tmp_file" +} + +######################## +# Cleans up temporary files created by credential_to_temp_file +# Arguments: +# None +# Returns: +# None +######################### +cleanup_credentials() { + debug "Cleaning up temporary files containing credentials" + rm -rf "${TMPDIR:-/tmp}"/at.cred.* +} diff --git a/bitnami/postgresql/18/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh b/bitnami/postgresql/18/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh index 1337f6c2dd59..b16efabd3230 100644 --- a/bitnami/postgresql/18/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh +++ b/bitnami/postgresql/18/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh @@ -131,6 +131,7 @@ relativize() { # -d|--dir-mode - mode for files. # -u|--user - user # -g|--group - group +# -n|--no-dereference - do not follow symlinks (use for runtime root chown of daemon-writable dirs) # Returns: # None ######################### @@ -140,6 +141,7 @@ configure_permissions_ownership() { local file_mode="" local user="" local group="" + local follow_symlinks="yes" # Validate arguments shift 1 @@ -161,6 +163,9 @@ configure_permissions_ownership() { shift group="${1:?missing group}" ;; + -n | --no-dereference) + follow_symlinks="no" + ;; *) echo "Invalid command line flag $1" >&2 return 1 @@ -169,22 +174,29 @@ configure_permissions_ownership() { shift done + # -L: follow symlinks and emits the target path + # This is dangerous at runtime, given a co-located lower-privileged process with write access + # to the target path can redirect the chown/chmod to arbitrary paths. Example: + # Lower-privileged process run: ln -s /etc /tmp/etc + # Then, setup.sh runs: configure_permissions_ownership --dir-mode 775 /tmp + local find_L_flag=(); [[ "$follow_symlinks" == "yes" ]] && find_L_flag=("-L") + # -h: changes symlink inode ownership without touching the target. + local chown_flags=(); [[ "$follow_symlinks" == "no" ]] && chown_flags=("-h") read -r -a filepaths <<<"$paths" for p in "${filepaths[@]}"; do if [[ -e "$p" ]]; then - find -L "$p" -printf "" if [[ -n $dir_mode ]]; then - find -L "$p" -type d ! -perm "$dir_mode" -print0 | xargs -r -0 chmod "$dir_mode" + find "${find_L_flag[@]}" "$p" -not -type l -type d ! -perm "$dir_mode" -print0 | xargs -r -0 chmod "$dir_mode" fi if [[ -n $file_mode ]]; then - find -L "$p" -type f ! -perm "$file_mode" -print0 | xargs -r -0 chmod "$file_mode" + find "${find_L_flag[@]}" "$p" -not -type l -type f ! -perm "$file_mode" -print0 | xargs -r -0 chmod "$file_mode" fi if [[ -n $user ]] && [[ -n $group ]]; then - find -L "$p" -print0 | xargs -r -0 chown "${user}:${group}" + find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chown "${chown_flags[@]}" "${user}:${group}" elif [[ -n $user ]] && [[ -z $group ]]; then - find -L "$p" -print0 | xargs -r -0 chown "${user}" + find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chown "${chown_flags[@]}" "${user}" elif [[ -z $user ]] && [[ -n $group ]]; then - find -L "$p" -print0 | xargs -r -0 chgrp "${group}" + find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chgrp "${chown_flags[@]}" "${group}" fi else stderr_print "$p does not exist" diff --git a/bitnami/postgresql/18/debian-12/rootfs/opt/bitnami/scripts/libautoctl.sh b/bitnami/postgresql/18/debian-12/rootfs/opt/bitnami/scripts/libautoctl.sh deleted file mode 100644 index f2af15066bcc..000000000000 --- a/bitnami/postgresql/18/debian-12/rootfs/opt/bitnami/scripts/libautoctl.sh +++ /dev/null @@ -1,308 +0,0 @@ -#!/bin/bash -# Copyright Broadcom, Inc. All Rights Reserved. -# SPDX-License-Identifier: APACHE-2.0 -# -# Bitnami pg_auto_failover library - -# shellcheck disable=SC1090,SC1091 - -# Load PostgreSQL library -. /opt/bitnami/scripts/libpostgresql.sh - -######################## -# Change pg_hba.conf so it allows access from replication users -# Globals: -# POSTGRESQL_* -# Arguments: -# None -# Returns: -# None -######################### -autoctl_configure_pghba() { - local replication_auth="trust" - if [[ -n "${POSTGRESQL_REPLICATION_PASSWORD}" ]]; then - replication_auth="md5" - fi - - cat <"${POSTGRESQL_PGHBA_FILE}" -local all all trust -EOF - - if [[ "${POSTGRESQL_AUTOCTL_MODE}" = "monitor" ]]; then - cat <>"${POSTGRESQL_PGHBA_FILE}" -host pg_auto_failover autoctl_node 0.0.0.0/0 ${replication_auth} -EOF - elif [[ "${POSTGRESQL_AUTOCTL_MODE}" = "postgres" ]]; then - cat <>"${POSTGRESQL_PGHBA_FILE}" -host all all 0.0.0.0/0 ${replication_auth} -host all all ::/0 ${replication_auth} -host replication pgautofailover_replicator 0.0.0.0/0 ${replication_auth} -EOF - fi - - cp "${POSTGRESQL_PGHBA_FILE}" "${POSTGRESQL_DATA_DIR}/pg_hba.conf" -} - -######################## -# Configure the auth parameters -# Globals: -# POSTGRESQL_* -# Arguments: -# None -# Returns: -# None -######################### -autoctl_configure_auth() { - info "Configuring auth parameters for (${POSTGRESQL_DATA_DIR})..." - - if [[ -f ${POSTGRESQL_DATA_DIR}/.autoctl_initialized ]]; then - info "Auth parameters are already configured, restoring from existing data" - else - postgresql_start_bg - - if [[ -n "${POSTGRESQL_REPLICATION_PASSWORD}" ]]; then - info "Changing replication passwords" - - local -r escaped_password="${POSTGRESQL_REPLICATION_PASSWORD//\'/\'\'}" - if [[ "${POSTGRESQL_AUTOCTL_MODE}" = "monitor" ]]; then - echo "ALTER USER autoctl_node WITH PASSWORD '${escaped_password}';" | postgresql_execute - elif [[ "${POSTGRESQL_AUTOCTL_MODE}" = "postgres" ]]; then - echo "ALTER USER pgautofailover_replicator WITH PASSWORD '${escaped_password}';" | postgresql_execute - pg_autoctl config set --pgdata "${POSTGRESQL_DATA_DIR}" replication.password "${POSTGRESQL_REPLICATION_PASSWORD}" - fi - fi - - if [[ "${POSTGRESQL_AUTOCTL_MODE}" = "postgres" ]]; then - info "Adding users auth configurations..." - [[ -n "$POSTGRESQL_DATABASE" ]] && [[ "$POSTGRESQL_DATABASE" != "postgres" ]] && postgresql_create_custom_database "$POSTGRESQL_DATABASE" - if [[ "$POSTGRESQL_USERNAME" = "postgres" ]]; then - postgresql_alter_postgres_user "$POSTGRESQL_PASSWORD" - else - if [[ -n "$POSTGRESQL_POSTGRES_PASSWORD" ]]; then - postgresql_alter_postgres_user "$POSTGRESQL_POSTGRES_PASSWORD" - fi - postgresql_create_admin_user - fi - fi - - postgresql_stop - fi -} - -######################## -# Create a monitor -# Globals: -# POSTGRESQL_* -# Arguments: -# None -# Returns: -# None -######################### -autoctl_create_monitor() { - local -r default_hostname=${1:?default_hostname is required} - - "${POSTGRESQL_BIN_DIR}/pg_autoctl" create monitor \ - --auth md5 \ - --pgdata "${POSTGRESQL_DATA_DIR}" \ - --no-ssl \ - --hostname "${POSTGRESQL_AUTOCTL_HOSTNAME:-$default_hostname}" -} - -######################## -# Build monitor URI -# Globals: -# POSTGRESQL_* -# Arguments: -# None -# Returns: -# None -######################### -monitor_connection_string() { - echo "postgres://autoctl_node:${POSTGRESQL_REPLICATION_PASSWORD}@${POSTGRESQL_AUTOCTL_MONITOR_HOST}/pg_auto_failover?connect_timeout=2" -} - -######################## -# Create a postgress node -# Globals: -# POSTGRESQL_* -# Arguments: -# None -# Returns: -# None -######################### -autoctl_create_postgres() { - local -r default_hostname=${1:?default_hostname is required} - - PGPASSWORD="${POSTGRESQL_REPLICATION_PASSWORD}" "${POSTGRESQL_BIN_DIR}/pg_autoctl" create postgres \ - --auth md5 \ - --pgdata "${POSTGRESQL_DATA_DIR}" \ - --no-ssl \ - --monitor "$(monitor_connection_string)" \ - --name "${POSTGRESQL_AUTOCTL_HOSTNAME:-$default_hostname}" \ - --hostname "${POSTGRESQL_AUTOCTL_HOSTNAME:-$default_hostname}" - - pg_autoctl config set --pgdata "${POSTGRESQL_DATA_DIR}" pg_autoctl.monitor "$(monitor_connection_string)" - wait_until_can_connect "$(monitor_connection_string)" -} - -######################## -# Create postgresql data dir using pg_autoclt -# Globals: -# POSTGRESQL_* -# Arguments: -# None -# Returns: -# None -######################### -autoctl_create_node() { - info "Creating ${POSTGRESQL_AUTOCTL_MODE} data directory (${POSTGRESQL_DATA_DIR})..." - - if [[ -f ${POSTGRESQL_DATA_DIR}/.autoctl_initialized ]]; then - info "A ${POSTGRESQL_AUTOCTL_MODE} data directory (${POSTGRESQL_DATA_DIR}) already exists, restoring from existing data" - else - info "Cleaning dbinit initialization files ${POSTGRESQL_DATA_DIR}..." - rm -rf "${POSTGRESQL_DATA_DIR:?}"/* - - local -r default_hostname="$(hostname --fqdn)" - if [[ "${POSTGRESQL_AUTOCTL_MODE}" = "monitor" ]]; then - autoctl_create_monitor "${default_hostname}" - elif [[ "${POSTGRESQL_AUTOCTL_MODE}" = "postgres" ]]; then - autoctl_create_postgres "${default_hostname}" - else - error "autoctl does not support ${POSTGRESQL_AUTOCTL_MODE}" - exit 1 - fi - fi -} - -######################## -# Add pgautofailover extension to shared_preload_libraries property in postgresql.conf -# Globals: -# POSTGRESQL_* -# Arguments: -# None -# Returns: -# None -######################### -autoctl_configure_pgautofailover() { - info "Load pgautofailover through POSTGRESQL_SHARED_PRELOAD_LIBRARIES env var..." - if [[ -f ${POSTGRESQL_DATA_DIR}/.autoctl_initialized ]]; then - info "The pgautofailover is already loaded, restoring from existing config" - else - local preload_libraries - if [[ -n "${POSTGRESQL_SHARED_PRELOAD_LIBRARIES}" ]]; then - preload_libraries="${POSTGRESQL_SHARED_PRELOAD_LIBRARIES},pgautofailover" - else - preload_libraries="pgautofailover" - fi - - postgresql_set_property "shared_preload_libraries" "${preload_libraries}" - fi -} - -######################## -# Add pgbackrest extension's configuration file and directories -# Globals: -# POSTGRESQL_* -# Arguments: -# None -# Returns: -# None -######################### -autoctl_configure_pgbackrest() { - if [[ -f ${POSTGRESQL_DATA_DIR}/.autoctl_initialized ]]; then - info "The pgbackrest is already configured" - else - info "Configuring pgbackrest..." - debug "Ensuring pgbackrest expected directories/files exist..." - for dir in "${POSTGRESQL_PGBACKREST_LOGS_DIR}" "${POSTGRESQL_PGBACKREST_BACKUPS_DIR}" "${POSTGRESQL_PGBACKREST_SPOOL_DIR}"; do - ensure_dir_exists "${dir}" - am_i_root && chown "${POSTGRESQL_DAEMON_USER}:${POSTGRESQL_DAEMON_GROUP}" "${dir}" - done - - cat <>"${POSTGRESQL_PGBACKREST_CONF_FILE}" -[global] -repo1-path=${POSTGRESQL_PGBACKREST_BACKUPS_DIR} -repo1-cipher-pass=${POSTGRESQL_REPLICATION_PASSWORD} -repo1-cipher-type=aes-256-cbc -repo1-retention-diff=1 -repo1-retention-full=2 -process-max=2 -log-path=${POSTGRESQL_PGBACKREST_LOGS_DIR} -log-level-console=info -log-level-file=debug -archive-async=y -spool-path=${POSTGRESQL_PGBACKREST_SPOOL_DIR} -start-fast=y -[testdb] -pg1-path=${POSTGRESQL_DATA_DIR} -EOF - fi -} - -######################## -# Initialize a monitor or postgress node using pg_autoctl command. -# Globals: -# POSTGRESQL_* -# Arguments: -# None -# Returns: -# None -######################### -autoctl_initialize() { - info "Initializing ${POSTGRESQL_AUTOCTL_MODE} data directory..." - - postgresql_unrestrict_pghba - autoctl_create_node - autoctl_configure_pgautofailover - autoctl_configure_pgbackrest - - if [[ ! -f ${POSTGRESQL_DATA_DIR}/.autoctl_initialized ]]; then - info "Moving configuration files to (${POSTGRESQL_DATA_DIR})..." - - cp "${POSTGRESQL_CONF_FILE}" "${POSTGRESQL_DATA_DIR}/postgresql.conf" - mkdir -p "${POSTGRESQL_DATA_DIR}/conf.d" - fi - - autoctl_configure_auth - autoctl_configure_pghba - - touch "${POSTGRESQL_DATA_DIR}/.autoctl_initialized" - info "Done initializing ${POSTGRESQL_AUTOCTL_MODE} data directory..." -} - -######################## -# Wait until a node is ready to accepts connection. -# Globals: -# POSTGRESQL_* -# Arguments: -# - $1 node hostname -# Returns: -# None -######################### -wait_until_can_connect() { - local connection_string="$1" - - check_postgresql_connection() { - psql "$connection_string" -c 'select version()' > /dev/null 2>&1 - } - - info "Wait until node is available..." - if ! retry_while "check_postgresql_connection"; then - error "Could not connect to the postgresql" - return 1 - fi -} - -######################## -# Change pg_hba.conf so only password-based authentication is allowed -# Globals: -# POSTGRESQL_* -# Arguments: -# None -# Returns: -# None -######################### -postgresql_unrestrict_pghba() { - replace_in_file "$POSTGRESQL_PGHBA_FILE" "md5" "trust" false -} diff --git a/bitnami/postgresql/18/debian-12/rootfs/opt/bitnami/scripts/libpostgresql.sh b/bitnami/postgresql/18/debian-12/rootfs/opt/bitnami/scripts/libpostgresql.sh index e0481e0240c3..50a1b1f04cc8 100644 --- a/bitnami/postgresql/18/debian-12/rootfs/opt/bitnami/scripts/libpostgresql.sh +++ b/bitnami/postgresql/18/debian-12/rootfs/opt/bitnami/scripts/libpostgresql.sh @@ -127,6 +127,10 @@ postgresql_validate() { empty_password_error "You can not set POSTGRESQL_LDAP_URL and POSTGRESQL_LDAP_SERVER at the same time. Check your LDAP configuration." fi + if is_boolean_yes "$POSTGRESQL_ENABLE_LDAP" && is_boolean_yes "$ALLOW_EMPTY_PASSWORD"; then + print_validation_error "You cannot enable LDAP authentication and allow empty passwords at the same time." + fi + if ! is_yes_no_value "$POSTGRESQL_SR_CHECK"; then print_validation_error "The values allowed for POSTGRESQL_SR_CHECK are: yes or no" elif is_boolean_yes "$POSTGRESQL_SR_CHECK" && [[ -z "$POSTGRESQL_SR_CHECK_USERNAME" || -z "$POSTGRESQL_SR_CHECK_DATABASE" ]]; then @@ -220,7 +224,15 @@ postgresql_ldap_auth_configuration() { [[ -n "$POSTGRESQL_LDAP_PORT" ]] && ldap_configuration+=" ldapport=${POSTGRESQL_LDAP_PORT}" [[ -n "$POSTGRESQL_LDAP_BASE_DN" ]] && ldap_configuration+=" ldapbasedn=\"${POSTGRESQL_LDAP_BASE_DN}\"" [[ -n "$POSTGRESQL_LDAP_BIND_DN" ]] && ldap_configuration+=" ldapbinddn=\"${POSTGRESQL_LDAP_BIND_DN}\"" - [[ -n "$POSTGRESQL_LDAP_BIND_PASSWORD" ]] && ldap_configuration+=" ldapbindpasswd=${POSTGRESQL_LDAP_BIND_PASSWORD}" + if [[ -n "$POSTGRESQL_LDAP_BIND_PASSWORD" ]]; then + if is_boolean_yes "$POSTGRESQL_LDAP_BIND_USE_PASSFILE" && [[ ! -f "${POSTGRESQL_LDAP_BIND_PASSFILE_PATH}" ]]; then + install -m 600 /dev/null "$POSTGRESQL_LDAP_BIND_PASSFILE_PATH" + echo "$POSTGRESQL_LDAP_BIND_PASSWORD" >> "$POSTGRESQL_LDAP_BIND_PASSFILE_PATH" + ldap_opts+=" ldapbindpasswdfile=${POSTGRESQL_LDAP_BIND_PASSFILE_PATH}" + else + ldap_opts+=" ldapbindpasswd=\"${POSTGRESQL_LDAP_BIND_PASSWORD}\"" + fi + fi [[ -n "$POSTGRESQL_LDAP_SEARCH_ATTR" ]] && ldap_configuration+=" ldapsearchattribute=${POSTGRESQL_LDAP_SEARCH_ATTR}" [[ -n "$POSTGRESQL_LDAP_SEARCH_FILTER" ]] && ldap_configuration+=" ldapsearchfilter=\"${POSTGRESQL_LDAP_SEARCH_FILTER}\"" [[ -n "$POSTGRESQL_LDAP_TLS" ]] && ldap_configuration+=" ldaptls=${POSTGRESQL_LDAP_TLS}" diff --git a/bitnami/postgresql/18/debian-12/rootfs/opt/bitnami/scripts/postgresql-env.sh b/bitnami/postgresql/18/debian-12/rootfs/opt/bitnami/scripts/postgresql-env.sh index b66bd4b68ec6..5a8b01924a1a 100644 --- a/bitnami/postgresql/18/debian-12/rootfs/opt/bitnami/scripts/postgresql-env.sh +++ b/bitnami/postgresql/18/debian-12/rootfs/opt/bitnami/scripts/postgresql-env.sh @@ -62,6 +62,8 @@ postgresql_env_vars=( POSTGRESQL_LDAP_BASE_DN POSTGRESQL_LDAP_BIND_DN POSTGRESQL_LDAP_BIND_PASSWORD + POSTGRESQL_LDAP_BIND_USE_PASSFILE + POSTGRESQL_LDAP_BIND_PASSFILE_PATH POSTGRESQL_LDAP_SEARCH_ATTR POSTGRESQL_LDAP_SEARCH_FILTER POSTGRESQL_INITSCRIPTS_USERNAME @@ -101,10 +103,6 @@ postgresql_env_vars=( POSTGRESQL_DEFAULT_TRANSACTION_ISOLATION POSTGRESQL_REPLICATION_NODES POSTGRESQL_PERFORM_RESTORE - POSTGRESQL_AUTOCTL_CONF_DIR - POSTGRESQL_AUTOCTL_MODE - POSTGRESQL_AUTOCTL_MONITOR_HOST - POSTGRESQL_AUTOCTL_HOSTNAME POSTGRES_DATA_DIR PGDATA POSTGRES_SHUTDOWN_MODE @@ -244,7 +242,7 @@ POSTGRESQL_REPLICATION_MODE="${POSTGRESQL_REPLICATION_MODE:-"${POSTGRES_REPLICAT export POSTGRESQL_REPLICATION_MODE="${POSTGRESQL_REPLICATION_MODE:-master}" POSTGRESQL_REPLICATION_USER="${POSTGRESQL_REPLICATION_USER:-"${POSTGRES_REPLICATION_USER:-}"}" export POSTGRESQL_REPLICATION_USER="${POSTGRESQL_REPLICATION_USER:-}" -export POSTGRESQL_REPLICATION_USE_PASSFILE="${POSTGRESQL_REPLICATION_USE_PASSFILE:-no}" +export POSTGRESQL_REPLICATION_USE_PASSFILE="${POSTGRESQL_REPLICATION_USE_PASSFILE:-yes}" export POSTGRESQL_REPLICATION_PASSFILE_PATH="${POSTGRESQL_REPLICATION_PASSFILE_PATH:-${POSTGRESQL_CONF_DIR}/.pgpass}" POSTGRESQL_SR_CHECK="${POSTGRESQL_SR_CHECK:-"${POSTGRES_SR_CHECK:-}"}" export POSTGRESQL_SR_CHECK="${POSTGRESQL_SR_CHECK:-no}" @@ -282,6 +280,8 @@ POSTGRESQL_LDAP_BIND_DN="${POSTGRESQL_LDAP_BIND_DN:-"${POSTGRES_LDAP_BIND_DN:-}" export POSTGRESQL_LDAP_BIND_DN="${POSTGRESQL_LDAP_BIND_DN:-}" POSTGRESQL_LDAP_BIND_PASSWORD="${POSTGRESQL_LDAP_BIND_PASSWORD:-"${POSTGRES_LDAP_BIND_PASSWORD:-}"}" export POSTGRESQL_LDAP_BIND_PASSWORD="${POSTGRESQL_LDAP_BIND_PASSWORD:-}" +export POSTGRESQL_LDAP_BIND_USE_PASSFILE="${POSTGRESQL_LDAP_BIND_USE_PASSFILE:-yes}" +export POSTGRESQL_LDAP_BIND_PASSFILE_PATH="${POSTGRESQL_LDAP_BIND_PASSFILE_PATH:-${POSTGRESQL_CONF_DIR}/.ldap_bindpass}" POSTGRESQL_LDAP_SEARCH_ATTR="${POSTGRESQL_LDAP_SEARCH_ATTR:-"${POSTGRES_LDAP_SEARCH_ATTR:-}"}" export POSTGRESQL_LDAP_SEARCH_ATTR="${POSTGRESQL_LDAP_SEARCH_ATTR:-}" POSTGRESQL_LDAP_SEARCH_FILTER="${POSTGRESQL_LDAP_SEARCH_FILTER:-"${POSTGRES_LDAP_SEARCH_FILTER:-}"}" @@ -358,13 +358,6 @@ export POSTGRESQL_REPLICATION_NODES="${POSTGRESQL_REPLICATION_NODES:-}" # Native recovery settings export POSTGRESQL_PERFORM_RESTORE="${POSTGRESQL_PERFORM_RESTORE:-no}" -# pgAutoFailover settings -export POSTGRESQL_AUTOCTL_VOLUME_DIR="${POSTGRESQL_VOLUME_DIR}/pgautoctl" -export POSTGRESQL_AUTOCTL_CONF_DIR="${POSTGRESQL_AUTOCTL_CONF_DIR:-${POSTGRESQL_AUTOCTL_VOLUME_DIR}/.config}" -export POSTGRESQL_AUTOCTL_MODE="${POSTGRESQL_AUTOCTL_MODE:-postgres}" -export POSTGRESQL_AUTOCTL_MONITOR_HOST="${POSTGRESQL_AUTOCTL_MONITOR_HOST:-monitor}" -export POSTGRESQL_AUTOCTL_HOSTNAME="${POSTGRESQL_AUTOCTL_HOSTNAME:-$(hostname --fqdn)}" - # pgBackRest settings export POSTGRESQL_PGBACKREST_VOLUME_DIR="${POSTGRESQL_VOLUME_DIR}/pgbackrest" export POSTGRESQL_PGBACKREST_LOGS_DIR="${POSTGRESQL_PGBACKREST_VOLUME_DIR}/logs" diff --git a/bitnami/postgresql/18/debian-12/rootfs/opt/bitnami/scripts/postgresql/run-autoctl.sh b/bitnami/postgresql/18/debian-12/rootfs/opt/bitnami/scripts/postgresql/run-autoctl.sh deleted file mode 100755 index aafedc8a66d0..000000000000 --- a/bitnami/postgresql/18/debian-12/rootfs/opt/bitnami/scripts/postgresql/run-autoctl.sh +++ /dev/null @@ -1,32 +0,0 @@ -#!/bin/bash -# Copyright Broadcom, Inc. All Rights Reserved. -# SPDX-License-Identifier: APACHE-2.0 - -# shellcheck disable=SC1091 - -set -o errexit -set -o nounset -set -o pipefail -# set -o xtrace # Uncomment this line for debugging purposes - -# Load libraries -. /opt/bitnami/scripts/libpostgresql.sh -. /opt/bitnami/scripts/libautoctl.sh -. /opt/bitnami/scripts/libos.sh - -# Load PostgreSQL environment variables -. /opt/bitnami/scripts/postgresql-env.sh - -export HOME="$POSTGRESQL_AUTOCTL_VOLUME_DIR" - -autoctl_initialize - -flags=("run" "--pgdata" "$POSTGRESQL_DATA_DIR") -cmd=$(command -v pg_autoctl) - -info "** Starting PostgreSQL autoctl_node (Mode: $POSTGRESQL_AUTOCTL_MODE) **" -if am_i_root; then - exec_as_user "$POSTGRESQL_DAEMON_USER" "$cmd" "${flags[@]}" -else - PGPASSWORD=$POSTGRESQL_REPLICATION_PASSWORD exec "$cmd" "${flags[@]}" -fi diff --git a/bitnami/postgresql/README.md b/bitnami/postgresql/README.md index af1846a0d5e8..1feef54a68ee 100644 --- a/bitnami/postgresql/README.md +++ b/bitnami/postgresql/README.md @@ -76,89 +76,87 @@ The following tables list the main variables you can set. #### Customizable environment variables -| Name | Description | Default Value | -|--------------------------------------------|------------------------------------------------------------------------------------------------------|--------------------------------------------| -| `POSTGRESQL_VOLUME_DIR` | Persistence base directory | `/bitnami/postgresql` | -| `POSTGRESQL_DATA_DIR` | PostgreSQL data directory | `${POSTGRESQL_VOLUME_DIR}/data` | -| `POSTGRESQL_EXTRA_FLAGS` | Extra flags for PostgreSQL initialization | `nil` | -| `POSTGRESQL_INIT_MAX_TIMEOUT` | Maximum initialization waiting timeout | `60` | -| `POSTGRESQL_PGCTLTIMEOUT` | Maximum waiting timeout for pg_ctl commands | `60` | -| `POSTGRESQL_SHUTDOWN_MODE` | Default mode for pg_ctl stop command | `fast` | -| `POSTGRESQL_CLUSTER_APP_NAME` | Replication cluster default application name | `walreceiver` | -| `POSTGRESQL_DATABASE` | Default PostgreSQL database | `postgres` | -| `POSTGRESQL_INITDB_ARGS` | Optional args for PostreSQL initdb operation | `nil` | -| `ALLOW_EMPTY_PASSWORD` | Allow password-less access | `no` | -| `POSTGRESQL_INITDB_WAL_DIR` | Optional init db wal directory | `nil` | -| `POSTGRESQL_MASTER_HOST` | PostgreSQL master host (used by slaves) | `nil` | -| `POSTGRESQL_MASTER_PORT_NUMBER` | PostgreSQL master host port (used by slaves) | `5432` | -| `POSTGRESQL_NUM_SYNCHRONOUS_REPLICAS` | Number of PostgreSQL replicas that should use synchronous replication | `0` | -| `POSTGRESQL_SYNCHRONOUS_REPLICAS_MODE` | PostgreSQL synchronous replication mode (values: empty, FIRST, ANY) | `nil` | -| `POSTGRESQL_PORT_NUMBER` | PostgreSQL port number | `5432` | -| `POSTGRESQL_ALLOW_REMOTE_CONNECTIONS` | Modify pg_hba settings so users can access from the outside | `yes` | -| `POSTGRESQL_REPLICATION_MODE` | PostgreSQL replication mode (values: master, slave) | `master` | -| `POSTGRESQL_REPLICATION_USER` | PostgreSQL replication user | `nil` | -| `POSTGRESQL_REPLICATION_USE_PASSFILE` | Use PGPASSFILE instead of PGPASSWORD | `no` | -| `POSTGRESQL_REPLICATION_PASSFILE_PATH` | Path to store passfile | `${POSTGRESQL_CONF_DIR}/.pgpass` | -| `POSTGRESQL_SR_CHECK` | Create user on PostgreSQL for Stream Replication Check | `no` | -| `POSTGRESQL_SR_CHECK_USERNAME` | Stream Replication Check user | `sr_check_user` | -| `POSTGRESQL_SR_CHECK_DATABASE` | Stream Replication Check database | `postgres` | -| `POSTGRESQL_SYNCHRONOUS_COMMIT_MODE` | Enable synchronous replication in slaves (number defined by POSTGRESQL_NUM_SYNCHRONOUS_REPLICAS) | `on` | -| `POSTGRESQL_FSYNC` | Enable fsync in write ahead logs | `on` | -| `POSTGRESQL_USERNAME` | PostgreSQL default username | `postgres` | -| `POSTGRESQL_ENABLE_LDAP` | Enable LDAP for PostgreSQL authentication | `no` | -| `POSTGRESQL_LDAP_URL` | PostgreSQL LDAP server url (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | -| `POSTGRESQL_LDAP_PREFIX` | PostgreSQL LDAP prefix (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | -| `POSTGRESQL_LDAP_SUFFIX` | PostgreSQL LDAP suffix (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | -| `POSTGRESQL_LDAP_SERVER` | PostgreSQL LDAP server (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | -| `POSTGRESQL_LDAP_PORT` | PostgreSQL LDAP port (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | -| `POSTGRESQL_LDAP_SCHEME` | PostgreSQL LDAP scheme (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | -| `POSTGRESQL_LDAP_TLS` | PostgreSQL LDAP tls setting (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | -| `POSTGRESQL_LDAP_BASE_DN` | PostgreSQL LDAP base DN settings (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | -| `POSTGRESQL_LDAP_BIND_DN` | PostgreSQL LDAP bind DN settings (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | -| `POSTGRESQL_LDAP_BIND_PASSWORD` | PostgreSQL LDAP bind password (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | -| `POSTGRESQL_LDAP_SEARCH_ATTR` | PostgreSQL LDAP search attribute (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | -| `POSTGRESQL_LDAP_SEARCH_FILTER` | PostgreSQL LDAP search filter (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | -| `POSTGRESQL_INITSCRIPTS_USERNAME` | Username for the psql scripts included in /docker-entrypoint.initdb | `$POSTGRESQL_USERNAME` | -| `POSTGRESQL_PASSWORD` | Password for the PostgreSQL created user | `nil` | -| `POSTGRESQL_POSTGRES_PASSWORD` | Password for the PostgreSQL postgres user | `nil` | -| `POSTGRESQL_REPLICATION_PASSWORD` | Password for the PostgreSQL replication user | `nil` | -| `POSTGRESQL_SR_CHECK_PASSWORD` | Password for the Stream Replication Check user | `nil` | -| `POSTGRESQL_INITSCRIPTS_PASSWORD` | Password for the PostgreSQL init scripts user | `$POSTGRESQL_PASSWORD` | -| `POSTGRESQL_ENABLE_TLS` | Whether to enable TLS for traffic or not | `no` | -| `POSTGRESQL_TLS_CERT_FILE` | File containing the certificate for the TLS traffic | `nil` | -| `POSTGRESQL_TLS_KEY_FILE` | File containing the key for certificate | `nil` | -| `POSTGRESQL_TLS_CA_FILE` | File containing the CA of the certificate | `nil` | -| `POSTGRESQL_TLS_CRL_FILE` | File containing a Certificate Revocation List | `nil` | -| `POSTGRESQL_TLS_PREFER_SERVER_CIPHERS` | Whether to use the server TLS cipher preferences rather than the client | `yes` | -| `POSTGRESQL_SHARED_PRELOAD_LIBRARIES` | List of libraries to preload at PostgreSQL initialization | `pgaudit` | -| `POSTGRESQL_PGAUDIT_LOG` | Comma-separated list of actions to log with pgaudit | `nil` | -| `POSTGRESQL_PGAUDIT_LOG_CATALOG` | Enable pgaudit log catalog (pgaudit.log_catalog setting) | `nil` | -| `POSTGRESQL_PGAUDIT_LOG_PARAMETER` | Enable pgaudit log parameter (pgaudit.log_parameter setting) | `nil` | -| `POSTGRESQL_LOG_CONNECTIONS` | Add a log entry per user connection | `nil` | -| `POSTGRESQL_LOG_DISCONNECTIONS` | Add a log entry per user disconnection | `nil` | -| `POSTGRESQL_LOG_HOSTNAME` | Log the client host name when accessing | `nil` | -| `POSTGRESQL_CLIENT_MIN_MESSAGES` | Set log level of errors to send to the client | `error` | -| `POSTGRESQL_LOG_LINE_PREFIX` | Set the format of the log lines | `nil` | -| `POSTGRESQL_LOG_TIMEZONE` | Set the log timezone | `nil` | -| `POSTGRESQL_TIMEZONE` | Set the timezone | `nil` | -| `POSTGRESQL_MAX_CONNECTIONS` | Set the maximum amount of connections | `nil` | -| `POSTGRESQL_TCP_KEEPALIVES_IDLE` | Set the TCP keepalive idle time | `nil` | -| `POSTGRESQL_TCP_KEEPALIVES_INTERVAL` | Set the TCP keepalive interval time | `nil` | -| `POSTGRESQL_TCP_KEEPALIVES_COUNT` | Set the TCP keepalive count | `nil` | -| `POSTGRESQL_STATEMENT_TIMEOUT` | Set the SQL statement timeout | `nil` | -| `POSTGRESQL_PGHBA_REMOVE_FILTERS` | Comma-separated list of strings for removing pg_hba.conf lines (example: md5, local) | `nil` | -| `POSTGRESQL_USERNAME_CONNECTION_LIMIT` | Set the user connection limit | `nil` | -| `POSTGRESQL_POSTGRES_CONNECTION_LIMIT` | Set the postgres user connection limit | `nil` | -| `POSTGRESQL_WAL_LEVEL` | Set the write-ahead log level | `replica` | -| `POSTGRESQL_DEFAULT_TOAST_COMPRESSION` | Set the postgres default compression | `nil` | -| `POSTGRESQL_PASSWORD_ENCRYPTION` | Set the passwords encryption method | `nil` | -| `POSTGRESQL_DEFAULT_TRANSACTION_ISOLATION` | Set transaction isolation | `nil` | -| `POSTGRESQL_REPLICATION_NODES` | Override value for synchronous_standby_names in postgresql.conf. Should be set if `REPMGR_NODE_NAME` | `nil` | -| `POSTGRESQL_PERFORM_RESTORE` | Flag to skip deletion of `recovery.signal` file to enable native recovery. e.g by using `wal-g` | `no` | -| `POSTGRESQL_AUTOCTL_CONF_DIR` | Path to the configuration dir for the pg_autoctl command | `${POSTGRESQL_AUTOCTL_VOLUME_DIR}/.config` | -| `POSTGRESQL_AUTOCTL_MODE` | pgAutoFailover node type, valid values [monitor, postgres] | `postgres` | -| `POSTGRESQL_AUTOCTL_MONITOR_HOST` | Hostname for the monitor component | `monitor` | -| `POSTGRESQL_AUTOCTL_HOSTNAME` | Hostname by which postgres is reachable | `$(hostname --fqdn)` | +| Name | Description | Default Value | +|--------------------------------------------|------------------------------------------------------------------------------------------------------|-----------------------------------------| +| `POSTGRESQL_VOLUME_DIR` | Persistence base directory | `/bitnami/postgresql` | +| `POSTGRESQL_DATA_DIR` | PostgreSQL data directory | `${POSTGRESQL_VOLUME_DIR}/data` | +| `POSTGRESQL_EXTRA_FLAGS` | Extra flags for PostgreSQL initialization | `nil` | +| `POSTGRESQL_INIT_MAX_TIMEOUT` | Maximum initialization waiting timeout | `60` | +| `POSTGRESQL_PGCTLTIMEOUT` | Maximum waiting timeout for pg_ctl commands | `60` | +| `POSTGRESQL_SHUTDOWN_MODE` | Default mode for pg_ctl stop command | `fast` | +| `POSTGRESQL_CLUSTER_APP_NAME` | Replication cluster default application name | `walreceiver` | +| `POSTGRESQL_DATABASE` | Default PostgreSQL database | `postgres` | +| `POSTGRESQL_INITDB_ARGS` | Optional args for PostreSQL initdb operation | `nil` | +| `ALLOW_EMPTY_PASSWORD` | Allow password-less access | `no` | +| `POSTGRESQL_INITDB_WAL_DIR` | Optional init db wal directory | `nil` | +| `POSTGRESQL_MASTER_HOST` | PostgreSQL master host (used by slaves) | `nil` | +| `POSTGRESQL_MASTER_PORT_NUMBER` | PostgreSQL master host port (used by slaves) | `5432` | +| `POSTGRESQL_NUM_SYNCHRONOUS_REPLICAS` | Number of PostgreSQL replicas that should use synchronous replication | `0` | +| `POSTGRESQL_SYNCHRONOUS_REPLICAS_MODE` | PostgreSQL synchronous replication mode (values: empty, FIRST, ANY) | `nil` | +| `POSTGRESQL_PORT_NUMBER` | PostgreSQL port number | `5432` | +| `POSTGRESQL_ALLOW_REMOTE_CONNECTIONS` | Modify pg_hba settings so users can access from the outside | `yes` | +| `POSTGRESQL_REPLICATION_MODE` | PostgreSQL replication mode (values: master, slave) | `master` | +| `POSTGRESQL_REPLICATION_USER` | PostgreSQL replication user | `nil` | +| `POSTGRESQL_REPLICATION_USE_PASSFILE` | Use PGPASSFILE instead of PGPASSWORD | `yes` | +| `POSTGRESQL_REPLICATION_PASSFILE_PATH` | Path to store passfile | `${POSTGRESQL_CONF_DIR}/.pgpass` | +| `POSTGRESQL_SR_CHECK` | Create user on PostgreSQL for Stream Replication Check | `no` | +| `POSTGRESQL_SR_CHECK_USERNAME` | Stream Replication Check user | `sr_check_user` | +| `POSTGRESQL_SR_CHECK_DATABASE` | Stream Replication Check database | `postgres` | +| `POSTGRESQL_SYNCHRONOUS_COMMIT_MODE` | Enable synchronous replication in slaves (number defined by POSTGRESQL_NUM_SYNCHRONOUS_REPLICAS) | `on` | +| `POSTGRESQL_FSYNC` | Enable fsync in write ahead logs | `on` | +| `POSTGRESQL_USERNAME` | PostgreSQL default username | `postgres` | +| `POSTGRESQL_ENABLE_LDAP` | Enable LDAP for PostgreSQL authentication | `no` | +| `POSTGRESQL_LDAP_URL` | PostgreSQL LDAP server url (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | +| `POSTGRESQL_LDAP_PREFIX` | PostgreSQL LDAP prefix (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | +| `POSTGRESQL_LDAP_SUFFIX` | PostgreSQL LDAP suffix (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | +| `POSTGRESQL_LDAP_SERVER` | PostgreSQL LDAP server (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | +| `POSTGRESQL_LDAP_PORT` | PostgreSQL LDAP port (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | +| `POSTGRESQL_LDAP_SCHEME` | PostgreSQL LDAP scheme (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | +| `POSTGRESQL_LDAP_TLS` | PostgreSQL LDAP tls setting (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | +| `POSTGRESQL_LDAP_BASE_DN` | PostgreSQL LDAP base DN settings (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | +| `POSTGRESQL_LDAP_BIND_DN` | PostgreSQL LDAP bind DN settings (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | +| `POSTGRESQL_LDAP_BIND_PASSWORD` | PostgreSQL LDAP bind password (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | +| `POSTGRESQL_LDAP_BIND_USE_PASSFILE` | Use a passfile for LDAP bind password | `yes` | +| `POSTGRESQL_LDAP_BIND_PASSFILE_PATH` | Path to store LDAP bind password passfile | `${POSTGRESQL_CONF_DIR}/.ldap_bindpass` | +| `POSTGRESQL_LDAP_SEARCH_ATTR` | PostgreSQL LDAP search attribute (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | +| `POSTGRESQL_LDAP_SEARCH_FILTER` | PostgreSQL LDAP search filter (requires POSTGRESQL_ENABLE_LDAP=yes) | `nil` | +| `POSTGRESQL_INITSCRIPTS_USERNAME` | Username for the psql scripts included in /docker-entrypoint.initdb | `$POSTGRESQL_USERNAME` | +| `POSTGRESQL_PASSWORD` | Password for the PostgreSQL created user | `nil` | +| `POSTGRESQL_POSTGRES_PASSWORD` | Password for the PostgreSQL postgres user | `nil` | +| `POSTGRESQL_REPLICATION_PASSWORD` | Password for the PostgreSQL replication user | `nil` | +| `POSTGRESQL_SR_CHECK_PASSWORD` | Password for the Stream Replication Check user | `nil` | +| `POSTGRESQL_INITSCRIPTS_PASSWORD` | Password for the PostgreSQL init scripts user | `$POSTGRESQL_PASSWORD` | +| `POSTGRESQL_ENABLE_TLS` | Whether to enable TLS for traffic or not | `no` | +| `POSTGRESQL_TLS_CERT_FILE` | File containing the certificate for the TLS traffic | `nil` | +| `POSTGRESQL_TLS_KEY_FILE` | File containing the key for certificate | `nil` | +| `POSTGRESQL_TLS_CA_FILE` | File containing the CA of the certificate | `nil` | +| `POSTGRESQL_TLS_CRL_FILE` | File containing a Certificate Revocation List | `nil` | +| `POSTGRESQL_TLS_PREFER_SERVER_CIPHERS` | Whether to use the server TLS cipher preferences rather than the client | `yes` | +| `POSTGRESQL_SHARED_PRELOAD_LIBRARIES` | List of libraries to preload at PostgreSQL initialization | `pgaudit` | +| `POSTGRESQL_PGAUDIT_LOG` | Comma-separated list of actions to log with pgaudit | `nil` | +| `POSTGRESQL_PGAUDIT_LOG_CATALOG` | Enable pgaudit log catalog (pgaudit.log_catalog setting) | `nil` | +| `POSTGRESQL_PGAUDIT_LOG_PARAMETER` | Enable pgaudit log parameter (pgaudit.log_parameter setting) | `nil` | +| `POSTGRESQL_LOG_CONNECTIONS` | Add a log entry per user connection | `nil` | +| `POSTGRESQL_LOG_DISCONNECTIONS` | Add a log entry per user disconnection | `nil` | +| `POSTGRESQL_LOG_HOSTNAME` | Log the client host name when accessing | `nil` | +| `POSTGRESQL_CLIENT_MIN_MESSAGES` | Set log level of errors to send to the client | `error` | +| `POSTGRESQL_LOG_LINE_PREFIX` | Set the format of the log lines | `nil` | +| `POSTGRESQL_LOG_TIMEZONE` | Set the log timezone | `nil` | +| `POSTGRESQL_TIMEZONE` | Set the timezone | `nil` | +| `POSTGRESQL_MAX_CONNECTIONS` | Set the maximum amount of connections | `nil` | +| `POSTGRESQL_TCP_KEEPALIVES_IDLE` | Set the TCP keepalive idle time | `nil` | +| `POSTGRESQL_TCP_KEEPALIVES_INTERVAL` | Set the TCP keepalive interval time | `nil` | +| `POSTGRESQL_TCP_KEEPALIVES_COUNT` | Set the TCP keepalive count | `nil` | +| `POSTGRESQL_STATEMENT_TIMEOUT` | Set the SQL statement timeout | `nil` | +| `POSTGRESQL_PGHBA_REMOVE_FILTERS` | Comma-separated list of strings for removing pg_hba.conf lines (example: md5, local) | `nil` | +| `POSTGRESQL_USERNAME_CONNECTION_LIMIT` | Set the user connection limit | `nil` | +| `POSTGRESQL_POSTGRES_CONNECTION_LIMIT` | Set the postgres user connection limit | `nil` | +| `POSTGRESQL_WAL_LEVEL` | Set the write-ahead log level | `replica` | +| `POSTGRESQL_DEFAULT_TOAST_COMPRESSION` | Set the postgres default compression | `nil` | +| `POSTGRESQL_PASSWORD_ENCRYPTION` | Set the passwords encryption method | `nil` | +| `POSTGRESQL_DEFAULT_TRANSACTION_ISOLATION` | Set transaction isolation | `nil` | +| `POSTGRESQL_REPLICATION_NODES` | Override value for synchronous_standby_names in postgresql.conf. Should be set if `REPMGR_NODE_NAME` | `nil` | +| `POSTGRESQL_PERFORM_RESTORE` | Flag to skip deletion of `recovery.signal` file to enable native recovery. e.g by using `wal-g` | `no` | #### Read-only environment variables @@ -181,7 +179,6 @@ The following tables list the main variables you can set. | `POSTGRESQL_DAEMON_USER` | PostgreSQL system user | `postgres` | | `POSTGRESQL_DAEMON_GROUP` | PostgreSQL system group | `postgres` | | `POSTGRESQL_USE_CUSTOM_PGHBA_INITIALIZATION` | Initialize PostgreSQL with the custom, mounted pg_hba.conf file | `no` | -| `POSTGRESQL_AUTOCTL_VOLUME_DIR` | The pg_autoctl home directory | `${POSTGRESQL_VOLUME_DIR}/pgautoctl` | | `POSTGRESQL_PGBACKREST_VOLUME_DIR` | The pgbackrest home directory | `${POSTGRESQL_VOLUME_DIR}/pgbackrest` | | `POSTGRESQL_PGBACKREST_LOGS_DIR` | The pgbackrest logs directory | `${POSTGRESQL_PGBACKREST_VOLUME_DIR}/logs` | | `POSTGRESQL_PGBACKREST_BACKUPS_DIR` | The pgbackrest backups directory | `${POSTGRESQL_PGBACKREST_VOLUME_DIR}/backups` |