|
| 1 | +#!/bin/bash |
| 2 | +set -e |
| 3 | + |
| 4 | +cat > "$PGDATA/server.key" <<-EOKEY |
| 5 | +-----BEGIN RSA PRIVATE KEY----- |
| 6 | +MIIEpAIBAAKCAQEAllItXwrj62MkxKVlz2FimJk42WWc3K82Rn2vAl6z38zQxSCj |
| 7 | +t9uWwXWTx5YOdGiUcA+JUAruZxqN7vdfphJoYtTrcrpT4rC/FsCMImBxkj1cxdYT |
| 8 | +q94SFn9bQBRZk7RUx4Kolt+/h0d3PpNIb4DbyQ8A0MVvNVxLpRRVwc6yQP+NkRMy |
| 9 | +gHR+m3P8fxHEtkHCVy7HORbASvN8fRlREMHDL2hkadX0BNM72DDo+DWhPA8GF6WX |
| 10 | +tIl1gU6GP6pSbEeMHD3f+uj7f9iSjvkrHrOt2nLUQ9Qnev2nhmU0/dOIweQ17/Fr |
| 11 | +lL9jYDUUFNORyjRnlXXUoP5BO/LdEAAqT2A0pwIDAQABAoIBAQCIXu74XUneHuiZ |
| 12 | +Wa+eTqwC4mZXmz6OWonzs0vU65NlgksXuv+r6ZO/2GoD1Bcy9jlL3Fxm+DPF56pB |
| 13 | +07u7TtHSb3VWdMFrU4tYGcBH45TE5dRHSmo4LlPcgxeGb6/ANwX+pYNKtJvuHyCH |
| 14 | +7Vf2iEFcCrdjrumv0BZ0IZmXJGxEV+7mK2Og0bZ/zbmJNaH25muuWj6BKlvLhL0N |
| 15 | +S2LlBjKx3HqtppUgUqNFqjLs6IA1u79S5dAomOsxZtnuByaX5WFzpktU2pveZmyF |
| 16 | +cl0dwHYZIaxR3ewYeQXGF8ANUmIx3nnxD2JOysPkitaGzeqt6dQZV14tPlDZDKat |
| 17 | +Vf0b6BHhAoGBAMWV7rG+7nVXoQ30CIcPGklkST3mVOlrzeBbKP1SeAwoGRbfsdhp |
| 18 | +rFMkh5UxTexnOzD4O8HPuJ6NGeWRQfqZT1nnjwHPeJWtiMHT6cnWxlzvxAZ61mio |
| 19 | +0jRfb8flhgFKk+G9+Xa6WaYAAwGWdF062EMe2Ym92oKM9ilTPGFVRk1XAoGBAMLD |
| 20 | +ETSQd2UqTF/y7wxMPqF3l6d1KBjwpuNuin2IjkXTOfGkDnAU3mSQlr7K1IPX8NPO |
| 21 | +gdyMfJoysfRaBuRcNA/o/0l0wyxW4HWtTtPYI0+pRCFtRLsI1MB997QKeaGKb+me |
| 22 | +3nBXkOksPSr9oa0Cs27z2cSoBOkpq2N/zzBseHExAoGAOyq3rKBZNehEwTHnb9I0 |
| 23 | +8+9FA3U6zh9LKjkCIEGW00Uapj/cOMsEIG2a8DEwfW84SWS8OEBkr43fSGBkGo/Y |
| 24 | +NDrkFw2ytVee0TQNGTTod6IQ2EPmera7I5XEml5/71kOyZWi40vQVqZAQDR2qgha |
| 25 | +BFdzmwywJ1Hg0OUs+pSXlccCgYEAgyOVki80NYolovWQwFcWVOKR2s+oECL6PGlS |
| 26 | +FvS714hCm9I7ZnymwlAZMJ6iOaRNJFEIX9i4jZtU95Mm0NzEsXHRc0SLpm9Y8+Oe |
| 27 | +EEaYgCsZFOjePpHTr0kiYLgs7fipIkU2wa40hMyk4y2kjzoiV7MaDrCTnevQ205T |
| 28 | +0+c1sgECgYBAXKcwdkh9JVSrLXFamsxiOx3MZ0n6J1d28wpdA3y4Y4AAJm4TGgFt |
| 29 | +eG/6qHRy6CHdFtJ7a84EMe1jaVLQJYW/VrOC2bWLftkU7qaOnkXHvr4CAHsXQHcx |
| 30 | +JhLfvh4ab3KyoK/iimifvcoS5z9gp7IBFKMyh5IeJ9Y75TgcfJ5HMg== |
| 31 | +-----END RSA PRIVATE KEY----- |
| 32 | +EOKEY |
| 33 | +chmod 0600 "$PGDATA/server.key" |
| 34 | + |
| 35 | +cat > "$PGDATA/server.crt" <<-EOCERT |
| 36 | +-----BEGIN CERTIFICATE----- |
| 37 | +MIID9DCCAtygAwIBAgIJAIYfg4EQ2pVAMA0GCSqGSIb3DQEBBQUAMFkxCzAJBgNV |
| 38 | +BAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBX |
| 39 | +aWRnaXRzIFB0eSBMdGQxEjAQBgNVBAMTCWxvY2FsaG9zdDAeFw0xNjA2MjgyMjQw |
| 40 | +NDFaFw0yNjA2MjYyMjQwNDFaMFkxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21l |
| 41 | +LVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxEjAQBgNV |
| 42 | +BAMTCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJZS |
| 43 | +LV8K4+tjJMSlZc9hYpiZONllnNyvNkZ9rwJes9/M0MUgo7fblsF1k8eWDnRolHAP |
| 44 | +iVAK7mcaje73X6YSaGLU63K6U+KwvxbAjCJgcZI9XMXWE6veEhZ/W0AUWZO0VMeC |
| 45 | +qJbfv4dHdz6TSG+A28kPANDFbzVcS6UUVcHOskD/jZETMoB0fptz/H8RxLZBwlcu |
| 46 | +xzkWwErzfH0ZURDBwy9oZGnV9ATTO9gw6Pg1oTwPBhell7SJdYFOhj+qUmxHjBw9 |
| 47 | +3/ro+3/Yko75Kx6zrdpy1EPUJ3r9p4ZlNP3TiMHkNe/xa5S/Y2A1FBTTkco0Z5V1 |
| 48 | +1KD+QTvy3RAAKk9gNKcCAwEAAaOBvjCBuzAdBgNVHQ4EFgQUEcuoFxzUZ4VV9VPv |
| 49 | +5frDyIuFA5cwgYsGA1UdIwSBgzCBgIAUEcuoFxzUZ4VV9VPv5frDyIuFA5ehXaRb |
| 50 | +MFkxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJ |
| 51 | +bnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxEjAQBgNVBAMTCWxvY2FsaG9zdIIJAIYf |
| 52 | +g4EQ2pVAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAHwMzmXdtz3R |
| 53 | +83HIdRQic40bJQf9ucSwY5ArkttPhC8ewQGyiGexm1Tvx9YA/qT2rscKPHXCPYcP |
| 54 | +IUE+nJTc8lQb8wPnFwGdHUsJfCvurxE4Yv4Oi74+q1enhHBGsvhFdFY5jTYD9unM |
| 55 | +zBEn+ZHX3PlKhe3wMub4khBTbPLK+n/laQWuZNsa+kj7BynkAg8W/6RK0Z0cJzzw |
| 56 | +aiVP0bSvatAAcSwkEfKEv5xExjWqoewjSlQLEZYIjJhXdtx/8AMnrcyxrFvKALUQ |
| 57 | +9M15FXvlPOB7ez14xIXQBKvvLwXvteHF6kYbzg/Bl1Q2GE9usclPa4UvTpnLv6gq |
| 58 | +NmFaAhoxnXA= |
| 59 | +-----END CERTIFICATE----- |
| 60 | +EOCERT |
| 61 | + |
| 62 | +cat >> "$PGDATA/postgresql.conf" <<-EOCONF |
| 63 | +port = 5433 |
| 64 | +ssl = on |
| 65 | +ssl_cert_file = 'server.crt' |
| 66 | +ssl_key_file = 'server.key' |
| 67 | +EOCONF |
| 68 | + |
| 69 | +cat > "$PGDATA/pg_hba.conf" <<-EOCONF |
| 70 | +# TYPE DATABASE USER ADDRESS METHOD |
| 71 | +host all pass_user 0.0.0.0/0 password |
| 72 | +host all md5_user 0.0.0.0/0 md5 |
| 73 | +host all scram_user 0.0.0.0/0 scram-sha-256 |
| 74 | +host all pass_user ::0/0 password |
| 75 | +host all md5_user ::0/0 md5 |
| 76 | +host all scram_user ::0/0 scram-sha-256 |
| 77 | +
|
| 78 | +hostssl all ssl_user 0.0.0.0/0 trust |
| 79 | +hostssl all ssl_user ::0/0 trust |
| 80 | +host all ssl_user 0.0.0.0/0 reject |
| 81 | +host all ssl_user ::0/0 reject |
| 82 | +
|
| 83 | +# IPv4 local connections: |
| 84 | +host all postgres 0.0.0.0/0 trust |
| 85 | +# IPv6 local connections: |
| 86 | +host all postgres ::0/0 trust |
| 87 | +# Unix socket connections: |
| 88 | +local all postgres trust |
| 89 | +EOCONF |
| 90 | + |
| 91 | +psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" <<-EOSQL |
| 92 | + CREATE ROLE pass_user PASSWORD 'password' LOGIN; |
| 93 | + CREATE ROLE md5_user PASSWORD 'password' LOGIN; |
| 94 | + SET password_encryption TO 'scram-sha-256'; |
| 95 | + CREATE ROLE scram_user PASSWORD 'password' LOGIN; |
| 96 | + CREATE ROLE ssl_user LOGIN; |
| 97 | + CREATE EXTENSION hstore; |
| 98 | + CREATE EXTENSION citext; |
| 99 | +EOSQL |
0 commit comments