asxpi/storage
1
0
Fork 0
Code Issues Pull requests Wiki Activity Actions

Provision read-only credentials for datacenterbingo
All checks were successful
Deploy storage stack / deploy (push) Successful in 19s
Details

Browse source 
The public bingo site is moving out of the asxpio container and only
needs to read the bingo tables and the bingo/ photos. Give it a role
limited to SELECT on those two tables (with read-only transactions by
default) and a MinIO user limited to GetObject under
asxpio-invoices/bingo/, instead of reusing asxpio's read-write
credentials.

Both steps are skipped while the BINGO_* secrets are unset, so this
deploys safely before they exist. Tables missing on a fresh install
are granted on the next deploy.

Assisted-by: Claude:opus-5
This commit is contained in:
Sergei Poljanski 2026-10-12 03:47:57 +04:00
commit b6bcc9f882
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
6 changed files with 86 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

29
init/minio-bootstrap.sh
View file

@ -37,6 +37,27 @@ EOF
|| mc admin policy update local "${name}" "/tmp/${name}.json"
}
# Read-only on one prefix of a bucket.
write_ro_prefix_policy() {
name="$1"
bucket="$2"
prefix="$3"
cat > "/tmp/${name}.json" <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:GetObject"],
"Resource": ["arn:aws:s3:::${bucket}/${prefix}*"]
}
]
}
EOF
mc admin policy create local "${name}" "/tmp/${name}.json" 2>/dev/null \
|| mc admin policy update local "${name}" "/tmp/${name}.json"
}
ensure_user() {
access="$1"
secret="$2"
@ -53,4 +74,12 @@ ensure_bucket "asxpio-invoices"
write_policy "asxpio-invoices-rw" "asxpio-invoices"
ensure_user "${ASXPIO_S3_ACCESS_KEY}" "${ASXPIO_S3_SECRET_KEY}" "asxpio-invoices-rw"
# datacenterbingo serves the card photos asxpio's admin uploads under bingo/.
if [ -n "${BINGO_S3_ACCESS_KEY:-}" ] && [ -n "${BINGO_S3_SECRET_KEY:-}" ]; then
write_ro_prefix_policy "asxpio-invoices-bingo-ro" "asxpio-invoices" "bingo/"
ensure_user "${BINGO_S3_ACCESS_KEY}" "${BINGO_S3_SECRET_KEY}" "asxpio-invoices-bingo-ro"
else
echo "minio-init: BINGO_S3_* unset, skipping bingo user"
fi
echo "minio-init: done"

25
init/postgres-init.sh
View file

@ -33,4 +33,29 @@ ensure_role "asxpio" "${ASXPIO_DB_PASSWORD}"
ensure_db "asxpio" "asxpio"
ensure_extension "asxpio" "citext"
# datacenterbingo: read-only on the bingo tables in the asxpio DB (asxpio's
# admin writes them and owns the schema). Tables that don't exist yet (fresh
# install, asxpio not migrated) are granted on the next storage deploy.
if [ -n "${BINGO_DB_PASSWORD:-}" ]; then
ensure_role "bingo" "${BINGO_DB_PASSWORD}"
psql -c "ALTER ROLE bingo SET default_transaction_read_only = on;"
psql -d asxpio -v ON_ERROR_STOP=1 <<'SQL' # heredoc body stays at column 0
GRANT CONNECT ON DATABASE asxpio TO bingo;
GRANT USAGE ON SCHEMA public TO bingo;
DO $$
DECLARE t text;
BEGIN
FOREACH t IN ARRAY ARRAY['bingo_datacenters', 'bingo_incidents'] LOOP
IF to_regclass('public.' || t) IS NOT NULL THEN
EXECUTE format('GRANT SELECT ON public.%I TO bingo', t);
ELSE
RAISE NOTICE 'bingo: % missing, not granted yet', t;
END IF;
END LOOP;
END $$;
SQL
else
echo "postgres-init: BINGO_DB_PASSWORD unset, skipping bingo role"
fi
echo "postgres-init: done"