Use secret seed for internal database passwords
Getting root-only read permissions into the Postgres image would
be tricky due to its init script nature. But it isn't exposed to
the outside anyway.
diff --git a/docker-compose.yml b/docker-compose.yml
index 603fdca..c45cf79 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -28,18 +28,22 @@
postgres:
build:
context: ./postgres/docker/
+ secrets:
+ - seed
networks:
- dbnet
volumes:
- ./postgres/postgres.conf:/etc/postgresql/postgresql.conf:ro
- ./postgres/init.sh:/docker-entrypoint-initdb.d/init.sh:ro
- ./postgres/data/:/var/lib/postgresql/data/:rw
- - ./postgres/passwd/:/tmp/passwd/:rw
keycloak:
build:
context: ./keycloak/docker/
args:
- KC_DB=postgres
+ secrets:
+ - source : seed
+ mode: 0400
networks:
- kcnet
- dbnet
@@ -57,8 +61,6 @@
- KC_DB_POOL_MAX_SIZE=16
- KEYCLOAK_ADMIN=deusarcadia
- KEYCLOAK_ADMIN_PASSWORD=arcanumhomini
- volumes:
- - ./postgres/passwd/keycloak/:/tmp/passwd/db/:ro
simpleid:
build:
context: .