From c33995f9c9c1976598f4321b226df9d8637f0a9c Mon Sep 17 00:00:00 2001
From: Alexander Pace <alexander.pace@ligo.org>
Date: Thu, 17 Oct 2019 14:59:56 -0400
Subject: [PATCH] modify entrypoint to accept docker secrets
---
docker/entrypoint | 31 +++++++++++++++++++++++++++++++
1 file changed, 31 insertions(+)
diff --git a/docker/entrypoint b/docker/entrypoint
index 0a50b5e44..d90572827 100644
--- a/docker/entrypoint
+++ b/docker/entrypoint
@@ -1,6 +1,37 @@
#!/bin/bash
+# Export the required UUID resource for the lvalert_overseer
export LVALERT_OVERSEER_RESOURCE=${LVALERT_USER}_overseer_$(python -c 'import uuid; print(uuid.uuid4().hex)')
+
+# Change the file permissions and ownership on /app/db_data:
chown gracedb:www-data /app/db_data
chmod 755 /app/db_data
+
+## PGA: 2019-10-15: use certs from secrets for Shibboleth SP
+SHIB_SP_CERT=/run/secrets/gracedb_ligo_org_saml_cert
+SHIB_SP_KEY=/run/secrets/gracedb_ligo_org_saml_privkey
+if [[ -f $SHIB_SP_CERT && -f $SHIB_SP_KEY ]]
+then
+ echo "Using Shibboleth Cert from docker secrets over the image one"
+ cp -f $SHIB_SP_CERT /etc/shibboleth/sp-cert.pem
+ cp -f $SHIB_SP_KEY /etc/shibboleth/sp-key.pem
+ chown _shibd:_shibd /etc/shibboleth/sp-{cert,key}.pem
+ chmod 0600 /etc/shibboleth/sp-key.pem
+fi
+
+## PGA 2019-10-16: use secrets for sensitive environment variables
+LIST="aws_ses_access_key_id
+ aws_ses_secret_access_key
+ django_db_password
+ django_secret_key
+ django_twilio_account_sid
+ django_twilio_auth_token
+ lvalert_password"
+
+for SECRET in $LIST
+do
+ VARNAME=$( tr [:lower:] [:upper:] <<<$SECRET)
+ [ -f /run/secrets/$SECRET ] && export $VARNAME="'$(< /run/secrets/$SECRET)'"
+done
+
exec "$@"
--
GitLab