Devin
78e1ff5dc8
PR #3 scrubbed ***REDACTED-LEGACY-PW*** from every env file, compose unit, and deployment doc but missed scripts/setup-database.sh, which still hard- coded DB_PASSWORD="***REDACTED-LEGACY-PW***" on line 17. That slipped past gitleaks because the shell-escaped form (backslash-dollar) does not match the L@kers?\$?2010 regex committed in .gitleaks.toml -- the regex was written to catch the *expanded* form, not the source form. This commit removes the hardcoded default and requires DB_PASSWORD to be exported by the operator before running the script. Same pattern as the rest of the PR #3 conversion (fail-fast at boot when a required secret is unset) so there is no longer any legitimate reason for the password string to live in the repo. Verification: git grep -nE 'L@kers?\\?\$?2010' -- scripts/ # no matches bash -n scripts/setup-database.sh # clean
77 lines
2.1 KiB
Bash
77 lines
2.1 KiB
Bash
#!/bin/bash
|
|
# Setup database user and database for custom explorer backend
|
|
|
|
set -e
|
|
|
|
echo "=== Setting up Database for Custom Explorer Backend ==="
|
|
echo ""
|
|
|
|
# Check if running as root or with sudo
|
|
if [ "$EUID" -ne 0 ]; then
|
|
echo "This script needs sudo privileges to create database user"
|
|
echo "Please run: sudo bash scripts/setup-database.sh"
|
|
exit 1
|
|
fi
|
|
|
|
DB_USER="${DB_USER:-explorer}"
|
|
DB_NAME="${DB_NAME:-explorer}"
|
|
if [ -z "${DB_PASSWORD:-}" ]; then
|
|
echo "ERROR: DB_PASSWORD environment variable must be set before running this script." >&2
|
|
echo "Generate a strong value (e.g. openssl rand -base64 32) and export it:" >&2
|
|
echo " export DB_PASSWORD='<strong random password>'" >&2
|
|
echo " sudo -E bash scripts/setup-database.sh" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "Creating database user: $DB_USER"
|
|
echo "Creating database: $DB_NAME"
|
|
echo ""
|
|
|
|
# Create user
|
|
echo "Creating user..."
|
|
sudo -u postgres psql << EOF
|
|
DO \$\$
|
|
BEGIN
|
|
IF NOT EXISTS (SELECT FROM pg_user WHERE usename = '$DB_USER') THEN
|
|
CREATE USER $DB_USER WITH PASSWORD '$DB_PASSWORD';
|
|
RAISE NOTICE 'User $DB_USER created';
|
|
ELSE
|
|
RAISE NOTICE 'User $DB_USER already exists';
|
|
END IF;
|
|
END
|
|
\$\$;
|
|
EOF
|
|
|
|
# Create database
|
|
echo "Creating database..."
|
|
sudo -u postgres psql << EOF
|
|
SELECT 'CREATE DATABASE $DB_NAME OWNER $DB_USER'
|
|
WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '$DB_NAME')\gexec
|
|
EOF
|
|
|
|
# Grant privileges
|
|
echo "Granting privileges..."
|
|
sudo -u postgres psql -d "$DB_NAME" << EOF
|
|
GRANT ALL PRIVILEGES ON DATABASE $DB_NAME TO $DB_USER;
|
|
GRANT ALL ON SCHEMA public TO $DB_USER;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO $DB_USER;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO $DB_USER;
|
|
EOF
|
|
|
|
echo ""
|
|
echo "✅ Database setup complete!"
|
|
echo ""
|
|
echo "Testing connection..."
|
|
export PGPASSWORD="$DB_PASSWORD"
|
|
if psql -h localhost -U "$DB_USER" -d "$DB_NAME" -c "SELECT 1;" > /dev/null 2>&1; then
|
|
echo "✅ Connection test successful"
|
|
else
|
|
echo "❌ Connection test failed"
|
|
echo "Please check PostgreSQL configuration"
|
|
fi
|
|
unset PGPASSWORD
|
|
|
|
echo ""
|
|
echo "You can now run: bash EXECUTE_DEPLOYMENT.sh"
|
|
|