Установка и инициализация

Установите podman:

apt-get update
apt-get install -y podman
podman --version

Создайте каталоги, например так:

mkdir -p /srv/altflow-postgres/data
mkdir -p /srv/altflow-postgres/conf
mkdir -p /srv/altflow-postgres/tls
mkdir -p /srv/altflow-postgres/init

Скопируйте файлы сертификата и ключа в TLS-каталог:

cp /path/to/your/server.crt /srv/altflow-postgres/tls/server.crt
cp /path/to/your/server.key /srv/altflow-postgres/tls/server.key
chmod 600 /srv/altflow-postgres/tls/server.key
chmod 644 /srv/altflow-postgres/tls/server.crt

Подготовьте pg_hba.conf так, чтобы пускать только TLS:

touch /srv/altflow-postgres/conf/pg_hba.conf

Содержимое файла:

# локальный сокет внутри контейнера
local   all             all                                     trust

# запретить обычный TCP без TLS
hostnossl all           all             0.0.0.0/0               reject
hostnossl all           all             ::0/0                   reject

# разрешить только TLS по паролю
hostssl  all            all             0.0.0.0/0               scram-sha-256
hostssl  all            all             ::0/0                   scram-sha-256

Подготовьте SQL для инициализации AltFlow SysDB:

touch /srv/altflow-postgres/init/01-sysdb.sql

Содержимое /01-sysdb.sql (SQL для развёртывания базы с нуля):

-- ========================================
-- Roles
-- ========================================

CREATE ROLE distributor_user LOGIN PASSWORD '<DISTRIBUTOR_PASSWORD>';
CREATE ROLE api_user LOGIN PASSWORD '<JWT_PASSWORD>';

-- ========================================
-- Database: distributor
-- ========================================

CREATE DATABASE distributor;
\connect distributor

CREATE TABLE helm_charts (
    stage TEXT PRIMARY KEY,
    helm_chart_name TEXT,
    helm_chart_ver TEXT,
    helm_repo TEXT
);

CREATE TABLE helm_repo (
    repo_name TEXT PRIMARY KEY,
    repo_url TEXT
);

CREATE TABLE tasks (
    id SERIAL PRIMARY KEY,
    stage VARCHAR(10) NOT NULL,
    helm TEXT NOT NULL
);

INSERT INTO helm_charts VALUES
('SIGN','sign-image','0.1.5','altflow-main'),
('BUILD','build-image','1.1.13','altflow-main'),
('PUSH','push-image','1.0.0','altflow-main');

INSERT INTO helm_repo VALUES
('altflow-main','<HELM_REPOSITORY_URL>');

GRANT CONNECT ON DATABASE distributor TO distributor_user;
GRANT USAGE ON SCHEMA public TO distributor_user;
GRANT SELECT ON helm_charts TO distributor_user;
GRANT SELECT ON helm_repo TO distributor_user;
GRANT SELECT ON tasks TO distributor_user;

-- ========================================
-- Database: jwt
-- ========================================

CREATE DATABASE jwt;
\connect jwt

CREATE TABLE permissions (
    id SERIAL PRIMARY KEY,
    permission_name VARCHAR,
    description VARCHAR
);

CREATE TABLE roles (
    id SERIAL PRIMARY KEY,
    role_name VARCHAR,
    permissions INTEGER[]
);

CREATE TABLE users (
    user_id VARCHAR PRIMARY KEY,
    username VARCHAR,
    roles INTEGER[]
);

INSERT INTO permissions VALUES
(1,'building-oci','Building oci-images');

INSERT INTO roles VALUES
(1,'builder','{1}');

GRANT CONNECT ON DATABASE jwt TO api_user;
GRANT USAGE ON SCHEMA public TO api_user;
GRANT ALL PRIVILEGES ON TABLE permissions TO api_user;
GRANT ALL PRIVILEGES ON TABLE roles TO api_user;
GRANT ALL PRIVILEGES ON TABLE users TO api_user;
GRANT USAGE, SELECT ON SEQUENCE permissions_id_seq TO api_user;
GRANT USAGE, SELECT ON SEQUENCE roles_id_seq TO api_user;

Загрузите образ контейнера:

podman pull registry.altlinux.org/p11/postgresql

Инициализируйте данные postgres:

chown 46:46 /srv/altflow-postgres/data
chmod 700 /srv/altflow-postgres/data

podman run --rm -it \
  --user 46:46 \
  -v /srv/altflow-postgres/data:/var/lib/postgresql/data \
  registry.altlinux.org/p11/postgresql \
  initdb -D /var/lib/postgresql/data --auth-host=scram-sha-256 --auth-local=trust

Запустите контейнер:

chown 46:46 /srv/altflow-postgres/tls/server.key /srv/altflow-postgres/tls/server.crt
chmod 600 /srv/altflow-postgres/tls/server.key
chmod 644 /srv/altflow-postgres/tls/server.crt

podman run -d \
  --name altflow-postgres \
  --restart=always \
  --user 46:46 \
  -p 5432:5432 \
  -v /srv/altflow-postgres/data:/var/lib/postgresql/data:Z \
  -v /srv/altflow-postgres/tls:/etc/postgresql/tls:ro,Z \
  -v /srv/altflow-postgres/conf/pg_hba.conf:/etc/postgresql/pg_hba.conf:ro,Z \
  registry.altlinux.org/p11/postgresql \
  postgres \
  -D /var/lib/postgresql/data \
  -c listen_addresses='*' \
  -c ssl=on \
  -c ssl_cert_file='/etc/postgresql/tls/server.crt' \
  -c ssl_key_file='/etc/postgresql/tls/server.key' \
  -c password_encryption='scram-sha-256' \
  -c hba_file='/etc/postgresql/pg_hba.conf'

Проверьте запущенный контейнер:

podman logs -f altflow-postgres

Зайдите в контейнер, чтобы задать пароль:

podman exec -it altflow-postgres psql -U postgres

Задайте пароль администратора:

ALTER USER postgres WITH PASSWORD '<STRONG_PASSWORD>';

Инициализируйте базы данных для altflow:

podman exec -i altflow-postgres psql -U postgres -d postgres < /srv/altflow-postgres/init/01-sysdb.sql