feat: add Database-Gateway Cloudron package (Infrastructure) [#639]

Database Gateway 0.24.0 as the 12th package: multi-stage Go build (CGO required by the libpg_query parser, hence an alpine:3.23 runtime matching upstream), native OIDC wired to the Cloudron platform identity provider, postgresql addon storage with goose migrations applied at start, jq-generated config + OPA policy seeded to /app/data. Verified end-to-end against a throwaway postgres (migrations, policy compile, startup to the OIDC handoff). Docs gardened to 12 packages. Ticket: https://projects.knownelement.com/issues/639
2026-09-01 19:28:06 -05:00
parent f918a90c3b
commit 3d38c507e8
10 changed files with 431 additions and 13 deletions
@@ -0,0 +1,65 @@
+# Database Gateway Cloudron Package
+#
+# Database Gateway (dbgw) is a web gateway for secure, policy-controlled
+# access to PostgreSQL databases: users log in via OIDC and every query is
+# parsed and authorized by embedded OPA policies (per user, target,
+# operation and table) before it reaches a remote database. Query results
+# are stored in a local PostgreSQL storage with shareable links.
+#
+# Upstream: https://github.com/kazhuravlev/database-gateway (v0.24.0, Go 1.26, Echo)
+#   - Single Go binary; the frontend is already built and embedded in the
+#     repo (internal/facade/ui/dist via go:embed), so no Node stage needed
+#   - Listens on 0.0.0.0:8080; config file passed with `-c config.json`
+#   - Storage schema applied via the `migrate-up` subcommand (embedded SQL)
+#
+# Authentication: NATIVE OIDC (preferred). start.sh wires the Cloudron
+# platform OIDC provider (CLOUDRON_OIDC_ISSUER / CLIENT_ID / CLIENT_SECRET)
+# into /app/data/config.json on first run; roles map from the Cloudron
+# `groups` claim (admins -> admin, users -> user).
+#
+# NOTE on base images: the SQL parser is a cgo binding (libpg_query), so the
+# binary MUST be built with CGO_ENABLED=1 — a static CGO_ENABLED=0 build
+# fails with `undefined: pg.Parse`. A musl-linked binary then needs a musl
+# runtime, hence alpine:3.23 (same as upstream's own image) instead of the
+# usual cloudron/base (Ubuntu/glibc).
+FROM golang:1.26-alpine AS builder
+
+ARG VERSION=v0.24.0
+
+WORKDIR /src
+
+# Mirrors the upstream Dockerfile build dependencies (git for module
+# fetches, gcc/musl-dev for the CGO-enabled build).
+RUN apk add --no-cache ca-certificates git gcc musl-dev
+
+# Cache dependency downloads separately from source changes.
+COPY repo/go.mod repo/go.sum ./
+RUN go mod download
+
+COPY repo/ .
+RUN CGO_ENABLED=1 go build \
+        -ldflags "-s -w -X github.com/dev-services42/version.version=${VERSION}" \
+        -o /out/database-gateway \
+        ./cmd/gateway
+
+# Same runtime base as the upstream image. The tools back start.sh:
+# bash (script), postgresql16-client (wait for the Cloudron PG addon),
+# jq (seed config.json), openssl (cookie secret).
+FROM alpine:3.23
+
+RUN apk add --no-cache bash ca-certificates jq openssl postgresql16-client
+
+COPY --from=builder /out/database-gateway /usr/local/bin/database-gateway
+
+# start.sh waits for the postgresql addon, seeds /app/data/config.json and
+# /app/data/opa/ on first run, applies migrations, then execs the gateway.
+# Made executable on the host, not at build time (Cloudron builds hit
+# permission errors on RUN chmod).
+COPY start.sh /app/start.sh
+
+ENV WORKDIR=/app/data
+WORKDIR ${WORKDIR}
+
+EXPOSE 8080
+
+CMD ["/bin/bash", "/app/start.sh"]