Skip to content

feat(minimal): add opt-in DB_SSL_ENABLED for RDS IAM-token auth #151

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
WolfangAukang wants to merge 1 commit into
base: master
Choose a base branch
from
+18 −3
Open

feat(minimal): add opt-in DB_SSL_ENABLED for RDS IAM-token auth #151

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,7 @@ The entrypoint script handles:
|---|---|
| `DB_SETUP` | `automatic`, `automatic-only`, `manual`, `delete` |
| `DB_SETUP_PASS` | Password used when setting up the DB |
| `DB_SSL_ENABLED` | Opt-in, **default off**. Set to exactly `true` to add `--ssl-mode=REQUIRED --enable-cleartext-plugin` to the privileged setup/delete MySQL client (required when `DB_SETUP_PASS` carries an RDS IAM auth token). Any other value / unset ⇒ unchanged plaintext-capable connection. |
| `SIMPLERISK_DB_HOSTNAME` | External DB host |
| `SIMPLERISK_DB_USERNAME/PASSWORD/DATABASE` | DB credentials |
| `SIMPLERISK_CRON_SETUP` | Enable/disable PHP cron (default: enabled) |
Expand Down
20 changes: 17 additions & 3 deletions simplerisk-minimal/common/entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -221,13 +221,24 @@ set_mail_settings(){
[ -n "${MAIL_PASSWORD:-}" ] && apply_mail_setting phpmailer_password "$MAIL_PASSWORD" || true
}

set_db_ssl_flags(){
# When DB_SETUP_PASS carries an RDS IAM auth token instead of a static
# password (e.g. EKS deploys against IAM-auth-only RDS), the privileged
# setup/delete mysql client must send the token in cleartext, which RDS
# only accepts over TLS. Set DB_SSL_ENABLED=true to opt into that path.
DB_SSL_FLAGS=""
if [ "${DB_SSL_ENABLED:-}" = "true" ]; then
DB_SSL_FLAGS="--ssl-mode=REQUIRED --enable-cleartext-plugin"
fi
}

delete_db(){
print_log "db_deletion: prepare" "Performing database deletion"

# Pass password via env var to avoid shell interpretation of special characters in the value
export MYSQL_PWD="$DB_SETUP_PASS"
# Needed to separate the GRANT statement from the rest because it was providing a syntax error
exec_cmd "mysql -u $DB_SETUP_USER -h$SIMPLERISK_DB_HOSTNAME -P$SIMPLERISK_DB_PORT <<EOSQL
exec_cmd "mysql ${DB_SSL_FLAGS:-} -u $DB_SETUP_USER -h$SIMPLERISK_DB_HOSTNAME -P$SIMPLERISK_DB_PORT <<EOSQL
SET sql_mode = 'ANSI_QUOTES';
DROP DATABASE \"${SIMPLERISK_DB_DATABASE}\";
USE mysql;
Expand Down Expand Up @@ -260,15 +271,15 @@ db_setup(){
# Pass password via env var to avoid shell interpretation of special characters in the value
export MYSQL_PWD="$DB_SETUP_PASS"
# Using sql_mode = ANSI_QUOTES to avoid using backticks
exec_cmd "mysql -u $DB_SETUP_USER -h$SIMPLERISK_DB_HOSTNAME -P$SIMPLERISK_DB_PORT <<EOSQL
exec_cmd "mysql ${DB_SSL_FLAGS:-} -u $DB_SETUP_USER -h$SIMPLERISK_DB_HOSTNAME -P$SIMPLERISK_DB_PORT <<EOSQL
SET sql_mode = 'ANSI_QUOTES';
CREATE DATABASE \"${SIMPLERISK_DB_DATABASE}\";
USE \"${SIMPLERISK_DB_DATABASE}\";
\. ${SCHEMA_FILE}
CREATE USER \"${SIMPLERISK_DB_USERNAME}\"@\"%\" IDENTIFIED BY \"${SIMPLERISK_DB_PASSWORD}\";
EOSQL" "Was not able to apply settings on database. Check error above. Exiting."
# Needed to separate the GRANT statement from the rest because it was providing a syntax error
exec_cmd "mysql -u $DB_SETUP_USER -h$SIMPLERISK_DB_HOSTNAME -P$SIMPLERISK_DB_PORT <<EOSQL
exec_cmd "mysql ${DB_SSL_FLAGS:-} -u $DB_SETUP_USER -h$SIMPLERISK_DB_HOSTNAME -P$SIMPLERISK_DB_PORT <<EOSQL
SET sql_mode = 'ANSI_QUOTES';
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER ON \"${SIMPLERISK_DB_DATABASE}\".* TO \"${SIMPLERISK_DB_USERNAME}\"@\"%\";
EOSQL" "Was not able to apply settings on database. Check error above. Exiting."
Expand All @@ -292,6 +303,8 @@ unset_variables() {
unset DB_SETUP_USER
unset DB_SETUP_PASS
unset DB_SETUP_WAIT
unset DB_SSL_ENABLED
unset DB_SSL_FLAGS
unset SIMPLERISK_DB_HOSTNAME
unset SIMPLERISK_DB_PORT
unset SIMPLERISK_DB_USERNAME
Expand Down Expand Up @@ -348,6 +361,7 @@ _main() {
if [[ -n ${DB_SETUP:-} ]]; then
DB_SETUP_USER="${DB_SETUP_USER:-root}"
DB_SETUP_PASS="${DB_SETUP_PASS:-root}"
set_db_ssl_flags
fi

if [[ -n ${SIMPLERISK_CSRF_SECRET:-} ]]; then
Expand Down
Loading