Story Crater Bot
674c8f0d66
- PostgreSQL 3-replica HA with pgvector - Vault S3 storage backend (MinIO) - Authentik federated OIDC provider - Vault auto-unseal via postStart hook
22 lines
683 B
Bash
Executable File
22 lines
683 B
Bash
Executable File
#!/bin/bash
|
|
# Safe database initialization script
|
|
# Applies init-users.sql with environment variable substitution
|
|
# Exit on any error
|
|
set -euo pipefail
|
|
|
|
# Get superuser password from CNPG secret
|
|
PG_PASSWORD=$(kubectl get secret -n ddb ddb-cluster-app -o jsonpath='{.data.password}' | base64 -d)
|
|
export PGPASSWORD="$PG_PASSWORD"
|
|
|
|
# Apply SQL with safe variable substitution (psql -v prevents injection)
|
|
psql \
|
|
-h ddb-cluster-rw.ddb.svc.cluster.local \
|
|
-U postgres \
|
|
-d postgres \
|
|
-v authentik_password="$AUTHENTIK_PG_PASSWORD" \
|
|
-v story_crater_password="$STORY_CRATER_PG_PASSWORD" \
|
|
-f k8s/ddb/init-users.sql
|
|
|
|
unset PGPASSWORD
|
|
echo "✓ Database initialization complete"
|