Sergei Poljanski
b6bcc9f882
All checks were successful
Deploy storage stack / deploy (push) Successful in 19s
The public bingo site is moving out of the asxpio container and only needs to read the bingo tables and the bingo/ photos. Give it a role limited to SELECT on those two tables (with read-only transactions by default) and a MinIO user limited to GetObject under asxpio-invoices/bingo/, instead of reusing asxpio's read-write credentials. Both steps are skipped while the BINGO_* secrets are unset, so this deploys safely before they exist. Tables missing on a fresh install are granted on the next deploy. Assisted-by: Claude:opus-5
85 lines
2.4 KiB
Bash
85 lines
2.4 KiB
Bash
#!/bin/sh
|
|
# Idempotent MinIO bootstrap: bucket + per-app service account scoped to that
|
|
# bucket. Re-running just refreshes the policy and resets the access key.
|
|
set -eu
|
|
|
|
mc alias set local http://minio:9000 "${MINIO_ROOT_USER}" "${MINIO_ROOT_PASSWORD}"
|
|
|
|
ensure_bucket() {
|
|
bucket="$1"
|
|
if ! mc ls "local/${bucket}" >/dev/null 2>&1; then
|
|
mc mb "local/${bucket}"
|
|
fi
|
|
mc anonymous set none "local/${bucket}" >/dev/null
|
|
}
|
|
|
|
write_policy() {
|
|
name="$1"
|
|
bucket="$2"
|
|
cat > "/tmp/${name}.json" <<EOF
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": ["s3:ListBucket", "s3:GetBucketLocation"],
|
|
"Resource": ["arn:aws:s3:::${bucket}"]
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
|
|
"Resource": ["arn:aws:s3:::${bucket}/*"]
|
|
}
|
|
]
|
|
}
|
|
EOF
|
|
mc admin policy create local "${name}" "/tmp/${name}.json" 2>/dev/null \
|
|
|| mc admin policy update local "${name}" "/tmp/${name}.json"
|
|
}
|
|
|
|
# Read-only on one prefix of a bucket.
|
|
write_ro_prefix_policy() {
|
|
name="$1"
|
|
bucket="$2"
|
|
prefix="$3"
|
|
cat > "/tmp/${name}.json" <<EOF
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": ["s3:GetObject"],
|
|
"Resource": ["arn:aws:s3:::${bucket}/${prefix}*"]
|
|
}
|
|
]
|
|
}
|
|
EOF
|
|
mc admin policy create local "${name}" "/tmp/${name}.json" 2>/dev/null \
|
|
|| mc admin policy update local "${name}" "/tmp/${name}.json"
|
|
}
|
|
|
|
ensure_user() {
|
|
access="$1"
|
|
secret="$2"
|
|
policy="$3"
|
|
if mc admin user info local "${access}" >/dev/null 2>&1; then
|
|
# Rotate secret to match desired state.
|
|
mc admin user remove local "${access}" >/dev/null
|
|
fi
|
|
mc admin user add local "${access}" "${secret}"
|
|
mc admin policy attach local "${policy}" --user "${access}" 2>/dev/null || true
|
|
}
|
|
|
|
ensure_bucket "asxpio-invoices"
|
|
write_policy "asxpio-invoices-rw" "asxpio-invoices"
|
|
ensure_user "${ASXPIO_S3_ACCESS_KEY}" "${ASXPIO_S3_SECRET_KEY}" "asxpio-invoices-rw"
|
|
|
|
# datacenterbingo serves the card photos asxpio's admin uploads under bingo/.
|
|
if [ -n "${BINGO_S3_ACCESS_KEY:-}" ] && [ -n "${BINGO_S3_SECRET_KEY:-}" ]; then
|
|
write_ro_prefix_policy "asxpio-invoices-bingo-ro" "asxpio-invoices" "bingo/"
|
|
ensure_user "${BINGO_S3_ACCESS_KEY}" "${BINGO_S3_SECRET_KEY}" "asxpio-invoices-bingo-ro"
|
|
else
|
|
echo "minio-init: BINGO_S3_* unset, skipping bingo user"
|
|
fi
|
|
|
|
echo "minio-init: done"
|