mrcharles
3d38c507e8
Database Gateway 0.24.0 as the 12th package: multi-stage Go build (CGO required by the libpg_query parser, hence an alpine:3.23 runtime matching upstream), native OIDC wired to the Cloudron platform identity provider, postgresql addon storage with goose migrations applied at start, jq-generated config + OPA policy seeded to /app/data. Verified end-to-end against a throwaway postgres (migrations, policy compile, startup to the OIDC handoff). Docs gardened to 12 packages. Ticket: https://projects.knownelement.com/issues/639
66 lines
2.6 KiB
Docker
66 lines
2.6 KiB
Docker
# Database Gateway Cloudron Package
|
|
#
|
|
# Database Gateway (dbgw) is a web gateway for secure, policy-controlled
|
|
# access to PostgreSQL databases: users log in via OIDC and every query is
|
|
# parsed and authorized by embedded OPA policies (per user, target,
|
|
# operation and table) before it reaches a remote database. Query results
|
|
# are stored in a local PostgreSQL storage with shareable links.
|
|
#
|
|
# Upstream: https://github.com/kazhuravlev/database-gateway (v0.24.0, Go 1.26, Echo)
|
|
# - Single Go binary; the frontend is already built and embedded in the
|
|
# repo (internal/facade/ui/dist via go:embed), so no Node stage needed
|
|
# - Listens on 0.0.0.0:8080; config file passed with `-c config.json`
|
|
# - Storage schema applied via the `migrate-up` subcommand (embedded SQL)
|
|
#
|
|
# Authentication: NATIVE OIDC (preferred). start.sh wires the Cloudron
|
|
# platform OIDC provider (CLOUDRON_OIDC_ISSUER / CLIENT_ID / CLIENT_SECRET)
|
|
# into /app/data/config.json on first run; roles map from the Cloudron
|
|
# `groups` claim (admins -> admin, users -> user).
|
|
#
|
|
# NOTE on base images: the SQL parser is a cgo binding (libpg_query), so the
|
|
# binary MUST be built with CGO_ENABLED=1 — a static CGO_ENABLED=0 build
|
|
# fails with `undefined: pg.Parse`. A musl-linked binary then needs a musl
|
|
# runtime, hence alpine:3.23 (same as upstream's own image) instead of the
|
|
# usual cloudron/base (Ubuntu/glibc).
|
|
FROM golang:1.26-alpine AS builder
|
|
|
|
ARG VERSION=v0.24.0
|
|
|
|
WORKDIR /src
|
|
|
|
# Mirrors the upstream Dockerfile build dependencies (git for module
|
|
# fetches, gcc/musl-dev for the CGO-enabled build).
|
|
RUN apk add --no-cache ca-certificates git gcc musl-dev
|
|
|
|
# Cache dependency downloads separately from source changes.
|
|
COPY repo/go.mod repo/go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY repo/ .
|
|
RUN CGO_ENABLED=1 go build \
|
|
-ldflags "-s -w -X github.com/dev-services42/version.version=${VERSION}" \
|
|
-o /out/database-gateway \
|
|
./cmd/gateway
|
|
|
|
# Same runtime base as the upstream image. The tools back start.sh:
|
|
# bash (script), postgresql16-client (wait for the Cloudron PG addon),
|
|
# jq (seed config.json), openssl (cookie secret).
|
|
FROM alpine:3.23
|
|
|
|
RUN apk add --no-cache bash ca-certificates jq openssl postgresql16-client
|
|
|
|
COPY --from=builder /out/database-gateway /usr/local/bin/database-gateway
|
|
|
|
# start.sh waits for the postgresql addon, seeds /app/data/config.json and
|
|
# /app/data/opa/ on first run, applies migrations, then execs the gateway.
|
|
# Made executable on the host, not at build time (Cloudron builds hit
|
|
# permission errors on RUN chmod).
|
|
COPY start.sh /app/start.sh
|
|
|
|
ENV WORKDIR=/app/data
|
|
WORKDIR ${WORKDIR}
|
|
|
|
EXPOSE 8080
|
|
|
|
CMD ["/bin/bash", "/app/start.sh"]
|