feat(db): inherit from scl image, enforce PG_ENCRYPT_KEY

db/Dockerfile

@@ -1,2 +1,9 @@
+# FROM registry.redhat.io/rhel8/postgresql-15:latest
 FROM docker.io/library/postgres:15
-COPY ./pgcrypto.sql /docker-entrypoint-initdb.d/
+
+RUN ln -s /usr/local/bin/docker-entrypoint.sh /usr/local/bin/postgres-entrypoint.sh
+
+ENTRYPOINT ["/usr/local/bin/cryostat-db-entrypoint.bash"]
+
+COPY ./pgcrypto.sql /docker-entrypoint-initdb.d/pgcrypto.sql
+COPY ./entrypoint.bash /usr/local/bin/cryostat-db-entrypoint.bash

db/entrypoint.bash

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+if [ "${DEBUG}" = "true" ]; then
+    set -xEeo pipefail
+fi
+
+if [ -z "${PG_ENCRYPT_KEY}" ]; then
+    echo "\$PG_ENCRYPT_KEY must be set and non-empty."
+    exit 1
+fi
+
+exec /usr/local/bin/postgres-entrypoint.sh postgres -c encrypt.key="${PG_ENCRYPT_KEY}" "$@"

smoketest/compose/db.yml

@@ -10,12 +10,6 @@ services:
   db:
     image: quay.io/cryostat/cryostat3-db:dev
     build: ../../db
-    entrypoint:
-      - /usr/local/bin/docker-entrypoint.sh
-    command:
-      - postgres
-      - -c
-      - encrypt.key=REPLACEME
     hostname: db
     expose:
       - "5432"