116 lines
3.5 KiB
YAML
116 lines
3.5 KiB
YAML
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: loomio-db-init
|
|
spec:
|
|
template:
|
|
spec:
|
|
restartPolicy: OnFailure
|
|
containers:
|
|
- name: db-init
|
|
image: loomio/loomio:latest
|
|
command:
|
|
- /bin/bash
|
|
- -c
|
|
- |
|
|
set -e
|
|
echo "Initializing Loomio database..."
|
|
DISABLE_DATABASE_ENVIRONMENT_CHECK=1 bundle exec rake db:migrate db:seed
|
|
echo "Database initialization complete"
|
|
env:
|
|
- name: RAILS_ENV
|
|
value: production
|
|
- name: DATABASE_URL
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: loomio-secrets
|
|
key: dbUrl
|
|
- name: REDIS_URL
|
|
value: {{ .redisUrl }}
|
|
- name: DEVISE_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: loomio-secrets
|
|
key: deviseSecret
|
|
- name: SECRET_COOKIE_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: loomio-secrets
|
|
key: secretCookieToken
|
|
initContainers:
|
|
- name: create-db
|
|
image: postgres:17-alpine
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 999
|
|
runAsGroup: 999
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: [ALL]
|
|
readOnlyRootFilesystem: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
env:
|
|
- name: PGHOST
|
|
value: "{{ .db.host }}"
|
|
- name: PGPORT
|
|
value: "{{ .db.port }}"
|
|
- name: PGUSER
|
|
value: postgres
|
|
- name: PGPASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: loomio-secrets
|
|
key: postgres.password
|
|
- name: APP_DB_NAME
|
|
value: "{{ .db.name }}"
|
|
- name: APP_DB_USER
|
|
value: "{{ .db.user }}"
|
|
- name: APP_DB_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: loomio-secrets
|
|
key: dbPassword
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
set -e
|
|
echo "Waiting for PostgreSQL to be ready..."
|
|
until pg_isready -h $PGHOST -p $PGPORT -U $PGUSER; do
|
|
sleep 2
|
|
done
|
|
psql -v ON_ERROR_STOP=1 <<-EOSQL
|
|
DO \$\$ BEGIN
|
|
IF NOT EXISTS (SELECT FROM pg_user WHERE usename = '$APP_DB_USER') THEN
|
|
CREATE USER $APP_DB_USER WITH PASSWORD '$APP_DB_PASSWORD';
|
|
ELSE
|
|
ALTER USER $APP_DB_USER WITH PASSWORD '$APP_DB_PASSWORD';
|
|
END IF;
|
|
END \$\$;
|
|
SELECT 'CREATE DATABASE $APP_DB_NAME OWNER $APP_DB_USER'
|
|
WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '$APP_DB_NAME')\gexec
|
|
GRANT ALL PRIVILEGES ON DATABASE $APP_DB_NAME TO $APP_DB_USER;
|
|
EOSQL
|
|
psql -d "$APP_DB_NAME" -v ON_ERROR_STOP=1 <<-EOSQL
|
|
GRANT ALL ON SCHEMA public TO $APP_DB_USER;
|
|
CREATE EXTENSION IF NOT EXISTS pg_stat_statements;
|
|
CREATE EXTENSION IF NOT EXISTS hstore;
|
|
CREATE EXTENSION IF NOT EXISTS pgcrypto;
|
|
EOSQL
|
|
echo "Database and user created"
|
|
securityContext:
|
|
runAsNonRoot: false
|
|
runAsUser: 0
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: [ALL]
|
|
readOnlyRootFilesystem: false
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
securityContext:
|
|
runAsNonRoot: false
|
|
runAsUser: 0
|
|
seccompProfile:
|
|
type: RuntimeDefault
|