feat(db): inherit from scl image, enforce PG_ENCRYPT_KEY

db/Dockerfile

@@ -1,2 +1,9 @@
+# FROM registry.redhat.io/rhel8/postgresql-15:latest
 FROM docker.io/library/postgres:15
-COPY ./pgcrypto.sql /docker-entrypoint-initdb.d/
+
+RUN ln -s /usr/local/bin/docker-entrypoint.sh /usr/local/bin/postgres-entrypoint.sh
+
+ENTRYPOINT ["/usr/local/bin/cryostat-db-entrypoint.bash"]
+
+COPY ./pgcrypto.sql /docker-entrypoint-initdb.d/pgcrypto.sql
+COPY ./entrypoint.bash /usr/local/bin/cryostat-db-entrypoint.bash

db/entrypoint.bash

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+if [ "${DEBUG}" = "true" ]; then
+    set -xEeo pipefail
+fi
+
+if [ "$1" = "postgres" ]; then
+    shift
+fi
+
+exec /usr/local/bin/postgres-entrypoint.sh \
+    postgres \
+    -c encrypt.key="${PG_ENCRYPT_KEY?:\$PG_ENCRYPT_KEY must be set and non-empty}" \
+    "$@"

smoketest/compose/db.yml

@@ -10,19 +10,14 @@ services:
   db:
     image: quay.io/cryostat/cryostat3-db:dev
     build: ../../db
-    entrypoint:
-      - /usr/local/bin/docker-entrypoint.sh
-    command:
-      - postgres
-      - -c
-      - encrypt.key=REPLACEME
     hostname: db
     expose:
       - "5432"
     environment:
       POSTGRES_USER: cryostat3
       POSTGRES_PASSWORD: cryostat3
       PG_ENCRYPT_KEY: REPLACEME
+      DEBUG: "true"
     volumes:
       - postgresql:/var/lib/postgresql/data
     restart: always

src/main/resources/application.properties

@@ -57,7 +57,8 @@ quarkus.datasource.devservices.enabled=true
 quarkus.datasource.devservices.image-name=quay.io/cryostat/cryostat3-db
 
 # !!! prod databases must set this configuration parameter some other way via a secret !!!
-quarkus.datasource.devservices.command=postgres -c encrypt.key=REPLACEME
+quarkus.datasource.devservices.container-env.PG_ENCRYPT_KEY=examplekey
+quarkus.datasource.devservices.container-env.DEBUG=true
 # !!!
 
 storage.buckets.archives.name=archivedrecordings