Skip to content

Commit 0c78b5f

Browse files
gbartolinigbartolini
committed
chore: convert to Unix file format (#2)
Signed-off-by: Gabriele Bartolini <[email protected]>
1 parent cd446ec commit 0c78b5f

File tree

7 files changed

+792
-792
lines changed

7 files changed

+792
-792
lines changed

‎docker/Dockerfile‎

Lines changed: 28 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,28 @@
1-
# syntax=docker/dockerfile:1.7
2-
FROM postgres:18 AS builder
3-
ARG DEBIAN_FRONTEND=noninteractive
4-
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
5-
set -eux; \
6-
apt-get update; \
7-
apt-get install -y --no-install-recommends \
8-
build-essential libcurl4-openssl-dev postgresql-server-dev-18; \
9-
apt-get clean; \
10-
rm -rf /var/lib/apt/lists/*
11-
WORKDIR /work
12-
COPY src/ ./src/
13-
RUN make -C src
14-
15-
FROM ghcr.io/cloudnative-pg/postgresql:18-standard-trixie
16-
ARG DEBIAN_FRONTEND=noninteractive
17-
USER root
18-
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
19-
set -eux; \
20-
apt-get update; \
21-
apt-get install -y --no-install-recommends libcurl4 ca-certificates; \
22-
apt-get clean; \
23-
rm -rf /var/lib/apt/lists/*
24-
COPY --chmod=0644 docker/certs/server.crt /usr/local/share/ca-certificates/kc-root.crt
25-
RUN update-ca-certificates
26-
ENV CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
27-
USER postgres
28-
COPY --from=builder /work/src/kc_validator.so /usr/lib/postgresql/18/lib/
1+
# syntax=docker/dockerfile:1.7
2+
FROM postgres:18 AS builder
3+
ARG DEBIAN_FRONTEND=noninteractive
4+
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
5+
set -eux; \
6+
apt-get update; \
7+
apt-get install -y --no-install-recommends \
8+
build-essential libcurl4-openssl-dev postgresql-server-dev-18; \
9+
apt-get clean; \
10+
rm -rf /var/lib/apt/lists/*
11+
WORKDIR /work
12+
COPY src/ ./src/
13+
RUN make -C src
14+
15+
FROM ghcr.io/cloudnative-pg/postgresql:18-standard-trixie
16+
ARG DEBIAN_FRONTEND=noninteractive
17+
USER root
18+
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
19+
set -eux; \
20+
apt-get update; \
21+
apt-get install -y --no-install-recommends libcurl4 ca-certificates; \
22+
apt-get clean; \
23+
rm -rf /var/lib/apt/lists/*
24+
COPY --chmod=0644 docker/certs/server.crt /usr/local/share/ca-certificates/kc-root.crt
25+
RUN update-ca-certificates
26+
ENV CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
27+
USER postgres
28+
COPY --from=builder /work/src/kc_validator.so /usr/lib/postgresql/18/lib/

‎examples/cnpg/cluster.yaml‎

Lines changed: 36 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,36 @@
1-
apiVersion: postgresql.cnpg.io/v1
2-
kind: Cluster
3-
metadata:
4-
name: pg-oauth
5-
spec:
6-
imageName: pg18-kc-validator:18.0
7-
instances: 1
8-
9-
# Bootstrap from scratch and run our init SQL from a ConfigMap
10-
bootstrap:
11-
initdb:
12-
database: appdb
13-
owner: app
14-
postInitApplicationSQLRefs:
15-
configMapRefs:
16-
- name: pg-init-sql
17-
key: init.sql
18-
19-
storage:
20-
size: 1Gi
21-
postgresql:
22-
parameters:
23-
oauth_validator_libraries: "kc_validator"
24-
25-
kc.token_endpoint: "https://<keycloak>/realms/<realm>/protocol/openid-connect/token"
26-
kc.audience: "postgres-resource"
27-
kc.resource_name: "appdb"
28-
kc.client_id: "postgres-resource"
29-
kc.http_timeout_ms: "2000"
30-
kc.expected_issuer: "https://<keycloak>/realms/<realm>"
31-
kc.debug: "on"
32-
kc.log_body: "on"
33-
log_min_messages: "debug1"
34-
35-
pg_hba:
36-
- host all all 0.0.0.0/0 oauth issuer="https://<keycloak>/realms/<realm>" scope=db_access validator="kc_validator" delegate_ident_mapping=1
1+
apiVersion: postgresql.cnpg.io/v1
2+
kind: Cluster
3+
metadata:
4+
name: pg-oauth
5+
spec:
6+
imageName: pg18-kc-validator:18.0
7+
instances: 1
8+
9+
# Bootstrap from scratch and run our init SQL from a ConfigMap
10+
bootstrap:
11+
initdb:
12+
database: appdb
13+
owner: app
14+
postInitApplicationSQLRefs:
15+
configMapRefs:
16+
- name: pg-init-sql
17+
key: init.sql
18+
19+
storage:
20+
size: 1Gi
21+
postgresql:
22+
parameters:
23+
oauth_validator_libraries: "kc_validator"
24+
25+
kc.token_endpoint: "https://<keycloak>/realms/<realm>/protocol/openid-connect/token"
26+
kc.audience: "postgres-resource"
27+
kc.resource_name: "appdb"
28+
kc.client_id: "postgres-resource"
29+
kc.http_timeout_ms: "2000"
30+
kc.expected_issuer: "https://<keycloak>/realms/<realm>"
31+
kc.debug: "on"
32+
kc.log_body: "on"
33+
log_min_messages: "debug1"
34+
35+
pg_hba:
36+
- host all all 0.0.0.0/0 oauth issuer="https://<keycloak>/realms/<realm>" scope=db_access validator="kc_validator" delegate_ident_mapping=1

‎examples/cnpg/pg-init-sql.yaml‎

Lines changed: 66 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -1,66 +1,66 @@
1-
apiVersion: v1
2-
kind: ConfigMap
3-
metadata:
4-
name: pg-init-sql
5-
data:
6-
init.sql: |
7-
-- Create the 'users' table
8-
CREATE TABLE IF NOT EXISTS users (
9-
id SERIAL PRIMARY KEY,
10-
username VARCHAR(50) NOT NULL UNIQUE,
11-
email VARCHAR(100) NOT NULL,
12-
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
13-
);
14-
15-
-- Create the 'orders' table
16-
CREATE TABLE IF NOT EXISTS orders (
17-
id SERIAL PRIMARY KEY,
18-
user_id INTEGER REFERENCES users(id),
19-
product VARCHAR(100),
20-
amount INTEGER,
21-
ordered_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
22-
);
23-
24-
-- Insert sample users
25-
INSERT INTO users (username, email) VALUES
26-
('alice', '[email protected]'),
27-
('bob', '[email protected]');
28-
29-
-- Insert sample orders
30-
INSERT INTO orders (user_id, product, amount) VALUES
31-
(1, 'Widget', 3),
32-
(2, 'Gadget', 5);
33-
34-
DO $$
35-
BEGIN
36-
IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'app_readonly') THEN
37-
CREATE ROLE app_readonly LOGIN;
38-
END IF;
39-
IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'app_readwrite') THEN
40-
CREATE ROLE app_readwrite LOGIN;
41-
END IF;
42-
END$$;
43-
44-
REVOKE CONNECT ON DATABASE appdb FROM PUBLIC;
45-
GRANT CONNECT ON DATABASE appdb TO app_readonly, app_readwrite;
46-
47-
REVOKE ALL ON SCHEMA public FROM PUBLIC;
48-
GRANT USAGE ON SCHEMA public TO app_readonly, app_readwrite;
49-
GRANT CREATE ON SCHEMA public TO app_readwrite;
50-
51-
GRANT SELECT ON ALL TABLES IN SCHEMA public TO app_readonly;
52-
GRANT SELECT ON ALL TABLES IN SCHEMA public TO app_readwrite;
53-
GRANT INSERT ON ALL TABLES IN SCHEMA public TO app_readwrite;
54-
55-
GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO app_readonly;
56-
GRANT USAGE, SELECT, UPDATE ON ALL SEQUENCES IN SCHEMA public TO app_readwrite;
57-
58-
ALTER DEFAULT PRIVILEGES IN SCHEMA public
59-
GRANT SELECT ON TABLES TO app_readonly;
60-
ALTER DEFAULT PRIVILEGES IN SCHEMA public
61-
GRANT USAGE, SELECT ON SEQUENCES TO app_readonly;
62-
63-
ALTER DEFAULT PRIVILEGES IN SCHEMA public
64-
GRANT SELECT, INSERT ON TABLES TO app_readwrite;
65-
ALTER DEFAULT PRIVILEGES IN SCHEMA public
66-
GRANT USAGE, SELECT, UPDATE ON SEQUENCES TO app_readwrite;
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: pg-init-sql
5+
data:
6+
init.sql: |
7+
-- Create the 'users' table
8+
CREATE TABLE IF NOT EXISTS users (
9+
id SERIAL PRIMARY KEY,
10+
username VARCHAR(50) NOT NULL UNIQUE,
11+
email VARCHAR(100) NOT NULL,
12+
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
13+
);
14+
15+
-- Create the 'orders' table
16+
CREATE TABLE IF NOT EXISTS orders (
17+
id SERIAL PRIMARY KEY,
18+
user_id INTEGER REFERENCES users(id),
19+
product VARCHAR(100),
20+
amount INTEGER,
21+
ordered_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
22+
);
23+
24+
-- Insert sample users
25+
INSERT INTO users (username, email) VALUES
26+
('alice', '[email protected]'),
27+
('bob', '[email protected]');
28+
29+
-- Insert sample orders
30+
INSERT INTO orders (user_id, product, amount) VALUES
31+
(1, 'Widget', 3),
32+
(2, 'Gadget', 5);
33+
34+
DO $$
35+
BEGIN
36+
IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'app_readonly') THEN
37+
CREATE ROLE app_readonly LOGIN;
38+
END IF;
39+
IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'app_readwrite') THEN
40+
CREATE ROLE app_readwrite LOGIN;
41+
END IF;
42+
END$$;
43+
44+
REVOKE CONNECT ON DATABASE appdb FROM PUBLIC;
45+
GRANT CONNECT ON DATABASE appdb TO app_readonly, app_readwrite;
46+
47+
REVOKE ALL ON SCHEMA public FROM PUBLIC;
48+
GRANT USAGE ON SCHEMA public TO app_readonly, app_readwrite;
49+
GRANT CREATE ON SCHEMA public TO app_readwrite;
50+
51+
GRANT SELECT ON ALL TABLES IN SCHEMA public TO app_readonly;
52+
GRANT SELECT ON ALL TABLES IN SCHEMA public TO app_readwrite;
53+
GRANT INSERT ON ALL TABLES IN SCHEMA public TO app_readwrite;
54+
55+
GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO app_readonly;
56+
GRANT USAGE, SELECT, UPDATE ON ALL SEQUENCES IN SCHEMA public TO app_readwrite;
57+
58+
ALTER DEFAULT PRIVILEGES IN SCHEMA public
59+
GRANT SELECT ON TABLES TO app_readonly;
60+
ALTER DEFAULT PRIVILEGES IN SCHEMA public
61+
GRANT USAGE, SELECT ON SEQUENCES TO app_readonly;
62+
63+
ALTER DEFAULT PRIVILEGES IN SCHEMA public
64+
GRANT SELECT, INSERT ON TABLES TO app_readwrite;
65+
ALTER DEFAULT PRIVILEGES IN SCHEMA public
66+
GRANT USAGE, SELECT, UPDATE ON SEQUENCES TO app_readwrite;

‎examples/keycloak/demo-realm.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2292,4 +2292,4 @@
22922292
"clientPolicies" : {
22932293
"policies" : [ ]
22942294
}
2295-
}
2295+
}

‎examples/keycloak/keycloak.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -193,4 +193,4 @@ spec:
193193
- protocol: TCP
194194
port: 5432
195195
targetPort: 5432
196-
type: ClusterIP
196+
type: ClusterIP

‎src/Makefile‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
1-
# Makefile for kc_validator (server module via PGXS)
2-
MODULE_big = kc_validator
3-
OBJS = kc_validator.o
4-
PG_CONFIG = pg_config
5-
6-
SHLIB_LINK += -lcurl
7-
8-
PGXS := $(shell $(PG_CONFIG) --pgxs)
9-
include $(PGXS)
1+
# Makefile for kc_validator (server module via PGXS)
2+
MODULE_big = kc_validator
3+
OBJS = kc_validator.o
4+
PG_CONFIG = pg_config
5+
6+
SHLIB_LINK += -lcurl
7+
8+
PGXS := $(shell $(PG_CONFIG) --pgxs)
9+
include $(PGXS)

0 commit comments

Comments
 (0)