We use Postgres 12.1 and Alpine 3.10.
Security is hardened:
- We do not use 'trust' even for local connections
- Requiring password authentication for all
- Using scram-sha-256 is stronger than md5
- Enforcing TLS communication
- Enforcing client-certificate verification
There are 2 users (lega_in and lega_out), and 2 schemas
(local_ega and local_ega_download).
The following environment variables can be used to configure the database:
| Variable | Description | Default value |
|---|---|---|
| PGDATA | The data directory | /ega/data |
| DB_LEGA_IN_PASSWORD | lega_in's password |
- |
| DB_LEGA_OUT_PASSWORD | lega_out's password |
- |
| TZ | Timezone for the Postgres server | Europe/Madrid |
As usual, include your own .sh, .sql or .sql.gz files in /docker-entrypoint-initdb.d/ in order to have them included at initialization time.
| Variable | Description | Default value |
|---|---|---|
| PG_SERVER_CERT | Public Certificate in PEM format | /etc/ega/pg.cert |
| PG_SERVER_KEY | Private Key in PEM format | /etc/ega/pg.key |
| PG_CA | Public CA Certificate in PEM format | /etc/ega/CA.cert |
| PG_VERIFY_PEER | Enforce client verification | 0 |
| SSL_SUBJ | Subject for the self-signed certificate creation | /C=ES/ST=Spain/L=Barcelona/O=CRG/OU=SysDevs/CN=LocalEGA/[email protected] |
If not already injected, the files located at PG_SERVER_CERT and PG_SERVER_KEY will be generated, as a self-signed public/private certificate pair, using SSL_SUBJ.
Client verification is enforced if and only if PG_CA exists and PG_VERIFY_PEER is set to 1.