Lars Nolden
2ce68cb098
- Move db/schema.sql to supabase/migrations/ as the first supabase CLI migration (manual `db push` only, no automated runner); re-add the gebos_ingest role + grants there since init.sql never re-runs - Add gebos-postgres-passwords oneshot on db-host: syncs role passwords from sops (LoadCredential, journal-safe), makes supabase_admin SUPERUSER and hands the auth schema to supabase_auth_admin to match the upstream supabase/postgres image; add pg_hba rule for 10.0.0.0/8 - Vendor the official docker-compose (studio/kong/auth/rest/meta only, external Postgres, loopback Studio with no Kong dashboard route) plus kong.yml (trimmed) and kong-entrypoint.sh (verbatim); tested: compose config, Kong config parse, migration applied on TimescaleDB pg17 - Document decisions as ADRs 0001-0004 (migrations, passwords, vendored stack, JWT API keys incl. verify/mint procedure) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
50 lines
2.7 KiB
Bash
50 lines
2.7 KiB
Bash
#!/bin/sh
|
|
# Custom entrypoint for Kong that builds Lua expressions for request-transformer
|
|
# and performs environment variable substitution in the declarative config.
|
|
|
|
# Build Lua expressions for translating opaque API keys to asymmetric JWTs.
|
|
# When opaque keys are not configured (empty env vars), expressions fall through
|
|
# to legacy-only behavior - just passing apikey as-is.
|
|
#
|
|
# Full expression logic (when opaque keys are configured):
|
|
# 1. If Authorization header exists and is NOT an sb_ key -> pass through (user session JWT)
|
|
# 2. If apikey matches secret key -> set service_role asymmetric JWT internal "API key"
|
|
# 3. If apikey matches publishable key -> set anon asymmetric JWT internal "API key"
|
|
# 4. Fallback: pass apikey as-is (legacy HS256 JWT)
|
|
|
|
if [ -n "$SUPABASE_SECRET_KEY" ] && [ -n "$SUPABASE_PUBLISHABLE_KEY" ]; then
|
|
# Opaque keys configured -> full translation expressions
|
|
export LUA_AUTH_EXPR="\$((headers.authorization ~= nil and headers.authorization:sub(1, 10) ~= 'Bearer sb_' and headers.authorization) or (headers.apikey == '$SUPABASE_SECRET_KEY' and 'Bearer $SERVICE_ROLE_KEY_ASYMMETRIC') or (headers.apikey == '$SUPABASE_PUBLISHABLE_KEY' and 'Bearer $ANON_KEY_ASYMMETRIC') or headers.apikey)"
|
|
|
|
# Realtime WebSocket: reads from query_params.apikey (supabase-js sends apikey
|
|
# via query string), outputs to x-api-key header which Realtime checks first.
|
|
export LUA_RT_WS_EXPR="\$((query_params.apikey == '$SUPABASE_SECRET_KEY' and '$SERVICE_ROLE_KEY_ASYMMETRIC') or (query_params.apikey == '$SUPABASE_PUBLISHABLE_KEY' and '$ANON_KEY_ASYMMETRIC') or query_params.apikey)"
|
|
else
|
|
# Legacy API keys, not sb_ API keys -> pass apikey through unchanged
|
|
export LUA_AUTH_EXPR="\$((headers.authorization ~= nil and headers.authorization:sub(1, 10) ~= 'Bearer sb_' and headers.authorization) or headers.apikey)"
|
|
export LUA_RT_WS_EXPR="\$(query_params.apikey)"
|
|
fi
|
|
|
|
# Substitute environment variables in the Kong declarative config.
|
|
# Uses awk instead of eval/echo to preserve YAML quoting (eval strips double
|
|
# quotes, breaking "Header: value" patterns that YAML parses as mappings).
|
|
awk '{
|
|
result = ""
|
|
rest = $0
|
|
while (match(rest, /\$[A-Za-z_][A-Za-z_0-9]*/)) {
|
|
varname = substr(rest, RSTART + 1, RLENGTH - 1)
|
|
if (varname in ENVIRON) {
|
|
result = result substr(rest, 1, RSTART - 1) ENVIRON[varname]
|
|
} else {
|
|
result = result substr(rest, 1, RSTART + RLENGTH - 1)
|
|
}
|
|
rest = substr(rest, RSTART + RLENGTH)
|
|
}
|
|
print result rest
|
|
}' /home/kong/temp.yml > "$KONG_DECLARATIVE_CONFIG"
|
|
|
|
# Remove empty key-auth credentials (unconfigured opaque keys)
|
|
sed -i '/^[[:space:]]*- key:[[:space:]]*$/d' "$KONG_DECLARATIVE_CONFIG"
|
|
|
|
exec /entrypoint.sh kong docker-start
|