Proyecto LCX Dispatcharr multicuenta

2026-05-09 21:24:50 +02:00
commit f56b088643
721 changed files with 177870 additions and 0 deletions
@@ -0,0 +1,44 @@
+#!/bin/bash
+#
+# Fix TLS client key permissions and ownership for PostgreSQL.
+# libpq requires the client key to be 0600 or stricter.
+#
+# Triggers on:
+#   - Permissions too open (Docker Desktop mounts files as 0777)
+#   - Wrong ownership (Kubernetes secrets / Docker volumes mount as root;
+#     the application user can't read a root-owned 0600 key)
+#   - Read-only source (volume mounted :ro — can't chmod in place)
+#
+# Usage: source this script with FIXED_KEY_PATH set to the destination.
+#   FIXED_KEY_PATH="/data/.pg-client.key"
+#   . /app/docker/init/00-fix-pg-ssl-key.sh
+#
+# After sourcing, POSTGRES_SSL_KEY is updated to the fixed path if a copy
+# was needed. The caller is responsible for propagating the new value to
+# /etc/environment or profile.d if required.
+
+: "${FIXED_KEY_PATH:?FIXED_KEY_PATH must be set before sourcing fix-pg-ssl-key.sh}"
+
+if [ -n "${POSTGRES_SSL_KEY:-}" ] && [ -f "$POSTGRES_SSL_KEY" ]; then
+    _key_perms=$(stat -c '%a' "$POSTGRES_SSL_KEY" 2>/dev/null)
+    _key_owner=$(stat -c '%u' "$POSTGRES_SSL_KEY" 2>/dev/null)
+    _needs_fix=false
+
+    if [ "$_key_perms" != "600" ] && [ "$_key_perms" != "640" ]; then
+        _needs_fix=true
+    elif [ "$(id -u)" = "0" ] && [ -n "${PUID:-}" ] && [ "$_key_owner" != "$PUID" ]; then
+        _needs_fix=true
+    fi
+
+    if [ "$_needs_fix" = true ]; then
+        cp "$POSTGRES_SSL_KEY" "$FIXED_KEY_PATH"
+        chmod 600 "$FIXED_KEY_PATH"
+        if [ "$(id -u)" = "0" ] && [ -n "${PUID:-}" ]; then
+            chown "${PUID}:${PGID:-$PUID}" "$FIXED_KEY_PATH"
+        fi
+        export POSTGRES_SSL_KEY="$FIXED_KEY_PATH"
+        echo "Fixed PostgreSQL client key (perms: ${_key_perms}, owner: ${_key_owner} → ${PUID:-root}:600)"
+    fi
+
+    unset _key_perms _key_owner _needs_fix
+fi