diff --git a/pkg/docker/entrypoint.sh b/pkg/docker/entrypoint.sh index 51ac88d2117..705c2794109 100755 --- a/pkg/docker/entrypoint.sh +++ b/pkg/docker/entrypoint.sh @@ -1,38 +1,34 @@ #!/usr/bin/env bash # Fixup the passwd file, in case we're on OpenShift -if ! whoami > /dev/null 2>&1; then - if [ "$(id -u)" -ne 5050 ]; then - if [ -w /etc/passwd ]; then - echo "${USER_NAME:-pgadminr}:x:$(id -u):0:${USER_NAME:-pgadminr} user:${HOME}:/sbin/nologin" >> /etc/passwd - fi - fi +if ! whoami &>/dev/null && [[ $(id -u) != 5050 && -w /etc/passwd ]]; then + echo "${USER_NAME:-pgadminr}:x:$(id -u):0:${USER_NAME:-pgadminr} user:${HOME}:/sbin/nologin" >> /etc/passwd fi # usage: file_env VAR [DEFAULT] ie: file_env 'XYZ_DB_PASSWORD' 'example' # (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of # "$XYZ_DB_PASSWORD" from a file, for Docker's secrets feature) function file_env() { - local var="$1" - local fileVar="${var}_FILE" - local def="${2:-}" - if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then - printf >&2 'error: both %s and %s are set (but are exclusive)\n' "$var" "$fileVar" - exit 1 - fi - local val="$def" - if [ "${!var:-}" ]; then - val="${!var}" - elif [ "${!fileVar:-}" ]; then - val="$(< "${!fileVar}")" - fi - export "$var"="$val" - unset "$fileVar" + local var="$1" + local fileVar="${var}_FILE" + local def="${2:-}" + if [[ -n ${!var:-} && -n ${!fileVar:-} ]]; then + printf >&2 'error: both %s and %s are set (but are exclusive)\n' "$var" "$fileVar" + exit 1 + fi + local val="$def" + if [[ -n ${!var:-} ]]; then + val="${!var}" + elif [[ -n ${!fileVar:-} ]]; then + val="$(< "${!fileVar}")" + fi + export "$var"="$val" + unset "$fileVar" } # Set values for config variables that can be passed using secrets -if [ -n "${PGADMIN_CONFIG_CONFIG_DATABASE_URI_FILE}" ]; then - file_env PGADMIN_CONFIG_CONFIG_DATABASE_URI +if [[ -n $PGADMIN_CONFIG_CONFIG_DATABASE_URI_FILE ]]; then + file_env PGADMIN_CONFIG_CONFIG_DATABASE_URI fi file_env PGADMIN_DEFAULT_PASSWORD @@ -42,7 +38,7 @@ export CONFIG_DISTRO_FILE_PATH="${PGADMIN_CUSTOM_CONFIG_DISTRO_FILE:-/pgadmin4/c # provided by the user through the PGADMIN_CONFIG_* environment variables. # Only update the file on first launch. The empty file is created only in default path during the # container build so it can have the required ownership. -if [ ! -e "${CONFIG_DISTRO_FILE_PATH}" ] || [ "$(wc -m "${CONFIG_DISTRO_FILE_PATH}" 2>/dev/null | awk '{ print $1 }')" = "0" ]; then +if [[ ! -e $CONFIG_DISTRO_FILE_PATH || $(wc -m "${CONFIG_DISTRO_FILE_PATH}" 2>/dev/null | awk '{ print $1 }') == 0 ]]; then cat << EOF > "${CONFIG_DISTRO_FILE_PATH}" CA_FILE = '/etc/ssl/certs/ca-certificates.crt' LOG_FILE = '/dev/null' @@ -58,19 +54,16 @@ DEFAULT_BINARY_PATHS = { } EOF - # This is a bit kludgy, but necessary as the container uses BusyBox/ash as - # it's shell and not bash which would allow a much cleaner implementation - for var in $(env | grep "^PGADMIN_CONFIG_" | cut -d "=" -f 1); do - # shellcheck disable=SC2086 - # shellcheck disable=SC2046 - echo ${var#PGADMIN_CONFIG_} = $(eval "echo \$$var") >> "${CONFIG_DISTRO_FILE_PATH}" + # Iterate over PGADMIN_CONFIG_* environment variables and writes them to the config file + for var in "${!PGADMIN_CONFIG_@}"; do + echo "${var#PGADMIN_CONFIG_} = ${!var}" >> "${CONFIG_DISTRO_FILE_PATH}" done fi # Check whether the external configuration database exists if it is being used. external_config_db_exists="False" -if [ -n "${PGADMIN_CONFIG_CONFIG_DATABASE_URI}" ]; then - external_config_db_exists=$(cd /pgadmin4/pgadmin/utils && /venv/bin/python3 -c "from check_external_config_db import check_external_config_db; val = check_external_config_db("${PGADMIN_CONFIG_CONFIG_DATABASE_URI}"); print(val)") +if [[ -n $PGADMIN_CONFIG_CONFIG_DATABASE_URI ]]; then + external_config_db_exists=$(cd /pgadmin4/pgadmin/utils && /venv/bin/python3 -c "from check_external_config_db import check_external_config_db; val = check_external_config_db(${PGADMIN_CONFIG_CONFIG_DATABASE_URI}); print(val)") fi # DRY of the code to load the PGADMIN_SERVER_JSON_FILE @@ -79,14 +72,14 @@ function load_server_json_file() { EXTRA_ARGS="" - if [ "${PGADMIN_REPLACE_SERVERS_ON_STARTUP}" = "True" ]; then + if [[ $PGADMIN_REPLACE_SERVERS_ON_STARTUP == 'True' ]]; then EXTRA_ARGS="--replace" fi - if [ -f "${PGADMIN_SERVER_JSON_FILE}" ]; then + if [[ -f $PGADMIN_SERVER_JSON_FILE ]]; then # When running in Desktop mode, no user is created # so we have to import servers anonymously - if [ "${PGADMIN_CONFIG_SERVER_MODE}" = "False" ]; then + if [[ $PGADMIN_CONFIG_SERVER_MODE == 'False' ]]; then /venv/bin/python3 /pgadmin4/setup.py load-servers "${PGADMIN_SERVER_JSON_FILE}" ${EXTRA_ARGS} else /venv/bin/python3 /pgadmin4/setup.py load-servers "${PGADMIN_SERVER_JSON_FILE}" --user "${PGADMIN_DEFAULT_EMAIL}" ${EXTRA_ARGS} @@ -94,33 +87,33 @@ function load_server_json_file() { fi } -if [ ! -f /var/lib/pgadmin/pgadmin4.db ] && [ "${external_config_db_exists}" = "False" ]; then - if [ -z "${PGADMIN_DEFAULT_EMAIL}" ] || { [ -z "${PGADMIN_DEFAULT_PASSWORD}" ] && [ -z "${PGADMIN_DEFAULT_PASSWORD_FILE}" ]; }; then +if [[ ! -f /var/lib/pgadmin/pgadmin4.db && $external_config_db_exists == 'False' ]]; then + if [[ -z $PGADMIN_DEFAULT_EMAIL || (-z $PGADMIN_DEFAULT_PASSWORD && -z $PGADMIN_DEFAULT_PASSWORD_FILE) ]]; then echo 'You need to define the PGADMIN_DEFAULT_EMAIL and PGADMIN_DEFAULT_PASSWORD or PGADMIN_DEFAULT_PASSWORD_FILE environment variables.' exit 1 fi # Validate PGADMIN_DEFAULT_EMAIL CHECK_EMAIL_DELIVERABILITY="False" - if [ -n "${PGADMIN_CONFIG_CHECK_EMAIL_DELIVERABILITY}" ]; then + if [[ -n $PGADMIN_CONFIG_CHECK_EMAIL_DELIVERABILITY ]]; then CHECK_EMAIL_DELIVERABILITY=${PGADMIN_CONFIG_CHECK_EMAIL_DELIVERABILITY} fi ALLOW_SPECIAL_EMAIL_DOMAINS="[]" - if [ -n "${PGADMIN_CONFIG_ALLOW_SPECIAL_EMAIL_DOMAINS}" ]; then + if [[ -n $PGADMIN_CONFIG_ALLOW_SPECIAL_EMAIL_DOMAINS ]]; then ALLOW_SPECIAL_EMAIL_DOMAINS=${PGADMIN_CONFIG_ALLOW_SPECIAL_EMAIL_DOMAINS} fi GLOBALLY_DELIVERABLE="True" - if [ -n "${PGADMIN_CONFIG_GLOBALLY_DELIVERABLE}" ]; then + if [[ -n $PGADMIN_CONFIG_GLOBALLY_DELIVERABLE ]]; then GLOBALLY_DELIVERABLE=${PGADMIN_CONFIG_GLOBALLY_DELIVERABLE} fi - email_config="{'CHECK_EMAIL_DELIVERABILITY': ${CHECK_EMAIL_DELIVERABILITY}, 'ALLOW_SPECIAL_EMAIL_DOMAINS': ${ALLOW_SPECIAL_EMAIL_DOMAINS}, 'GLOBALLY_DELIVERABLE': ${GLOBALLY_DELIVERABLE}}" - echo "email config is ${email_config}" - is_valid_email=$(cd /pgadmin4/pgadmin/utils && /venv/bin/python3 -c "from validation_utils import validate_email; val = validate_email('${PGADMIN_DEFAULT_EMAIL}', ${email_config}); print(val)") - if echo "${is_valid_email}" | grep "False" > /dev/null; then - echo "'${PGADMIN_DEFAULT_EMAIL}' does not appear to be a valid email address. Please reset the PGADMIN_DEFAULT_EMAIL environment variable and try again." - echo "Validation output: ${is_valid_email}" - exit 1 - fi + email_config="{'CHECK_EMAIL_DELIVERABILITY': ${CHECK_EMAIL_DELIVERABILITY}, 'ALLOW_SPECIAL_EMAIL_DOMAINS': ${ALLOW_SPECIAL_EMAIL_DOMAINS}, 'GLOBALLY_DELIVERABLE': ${GLOBALLY_DELIVERABLE}}" + echo "email config is ${email_config}" + is_valid_email=$(cd /pgadmin4/pgadmin/utils && /venv/bin/python3 -c "from validation_utils import validate_email; val = validate_email('${PGADMIN_DEFAULT_EMAIL}', ${email_config}); print(val)") + if [[ $is_valid_email == *False* ]]; then + echo "'${PGADMIN_DEFAULT_EMAIL}' does not appear to be a valid email address. Please reset the PGADMIN_DEFAULT_EMAIL environment variable and try again." + echo "Validation output: ${is_valid_email}" + exit 1 + fi # Switch back to root directory for further process cd /pgadmin4 @@ -139,8 +132,8 @@ if [ ! -f /var/lib/pgadmin/pgadmin4.db ] && [ "${external_config_db_exists}" = " load_server_json_file # Pre-load any required preferences - if [ -f "${PGADMIN_PREFERENCES_JSON_FILE}" ]; then - if [ "${PGADMIN_CONFIG_SERVER_MODE}" = "False" ]; then + if [[ -f $PGADMIN_PREFERENCES_JSON_FILE ]]; then + if [[ $PGADMIN_CONFIG_SERVER_MODE == 'False' ]]; then DESKTOP_USER=$(cd /pgadmin4 && /venv/bin/python3 -c 'import config; print(config.DESKTOP_USER)') /venv/bin/python3 /pgadmin4/setup.py set-prefs "${DESKTOP_USER}" --input-file "${PGADMIN_PREFERENCES_JSON_FILE}" else @@ -148,24 +141,24 @@ if [ ! -f /var/lib/pgadmin/pgadmin4.db ] && [ "${external_config_db_exists}" = " fi fi # Copy the pgpass file passed using secrets - if [ -f "${PGPASS_FILE}" ]; then - if [ "${PGADMIN_CONFIG_SERVER_MODE}" = "False" ]; then - cp ${PGPASS_FILE} /var/lib/pgadmin/.pgpass + if [[ -f $PGPASS_FILE ]]; then + if [[ $PGADMIN_CONFIG_SERVER_MODE == 'False' ]]; then + cp "${PGPASS_FILE}" /var/lib/pgadmin/.pgpass chmod 600 /var/lib/pgadmin/.pgpass else PGADMIN_USER_CONFIG_DIR=$(echo "${PGADMIN_DEFAULT_EMAIL}" | sed 's/@/_/g') - mkdir -p /var/lib/pgadmin/storage/${PGADMIN_USER_CONFIG_DIR} - cp ${PGPASS_FILE} /var/lib/pgadmin/storage/${PGADMIN_USER_CONFIG_DIR}/.pgpass - chmod 600 /var/lib/pgadmin/storage/${PGADMIN_USER_CONFIG_DIR}/.pgpass + mkdir -p /var/lib/pgadmin/storage/"${PGADMIN_USER_CONFIG_DIR}" + cp "${PGPASS_FILE}" /var/lib/pgadmin/storage/"${PGADMIN_USER_CONFIG_DIR}"/.pgpass + chmod 600 /var/lib/pgadmin/storage/"${PGADMIN_USER_CONFIG_DIR}"/.pgpass fi fi # If already initialised and PGADMIN_REPLACE_SERVERS_ON_STARTUP is set to true, then load the server json file. -elif [ "${PGADMIN_REPLACE_SERVERS_ON_STARTUP}" = "True" ]; then +elif [[ $PGADMIN_REPLACE_SERVERS_ON_STARTUP == 'True' ]]; then load_server_json_file fi # Start Postfix to handle password resets etc. -if [ -z "${PGADMIN_DISABLE_POSTFIX}" ]; then +if [[ -z $PGADMIN_DISABLE_POSTFIX ]]; then sudo /usr/sbin/postfix start fi @@ -176,17 +169,15 @@ TIMEOUT=$(cd /pgadmin4 && /venv/bin/python3 -c 'import config; print(config.SESS # NOTE: currently pgadmin can run only with 1 worker due to sessions implementation # Using --threads to have multi-threaded single-process worker -if [ -n "${PGADMIN_ENABLE_SOCK}" ]; then +if [[ -n $PGADMIN_ENABLE_SOCK ]]; then BIND_ADDRESS="unix:/run/pgadmin/pgadmin.sock" +elif [[ -n $PGADMIN_ENABLE_TLS ]]; then + BIND_ADDRESS="${PGADMIN_LISTEN_ADDRESS:-[::]}:${PGADMIN_LISTEN_PORT:-443}" else - if [ -n "${PGADMIN_ENABLE_TLS}" ]; then - BIND_ADDRESS="${PGADMIN_LISTEN_ADDRESS:-[::]}:${PGADMIN_LISTEN_PORT:-443}" - else - BIND_ADDRESS="${PGADMIN_LISTEN_ADDRESS:-[::]}:${PGADMIN_LISTEN_PORT:-80}" - fi + BIND_ADDRESS="${PGADMIN_LISTEN_ADDRESS:-[::]}:${PGADMIN_LISTEN_PORT:-80}" fi -if [ -n "${PGADMIN_ENABLE_TLS}" ]; then +if [[ -n $PGADMIN_ENABLE_TLS ]]; then exec /venv/bin/gunicorn --limit-request-line "${GUNICORN_LIMIT_REQUEST_LINE:-8190}" --timeout "${TIMEOUT}" --bind "${BIND_ADDRESS}" -w 1 --threads "${GUNICORN_THREADS:-25}" --access-logfile "${GUNICORN_ACCESS_LOGFILE:--}" --keyfile /certs/server.key --certfile /certs/server.cert -c gunicorn_config.py run_pgadmin:app else exec /venv/bin/gunicorn --limit-request-line "${GUNICORN_LIMIT_REQUEST_LINE:-8190}" --limit-request-fields "${GUNICORN_LIMIT_REQUEST_FIELDS:-100}" --limit-request-field_size "${GUNICORN_LIMIT_REQUEST_FIELD_SIZE:-8190}" --timeout "${TIMEOUT}" --bind "${BIND_ADDRESS}" -w 1 --threads "${GUNICORN_THREADS:-25}" --access-logfile "${GUNICORN_ACCESS_LOGFILE:--}" -c gunicorn_config.py run_pgadmin:app