Use secret seed for internal database passwords
Getting root-only read permissions into the Postgres image would
be tricky due to its init script nature. But it isn't exposed to
the outside anyway.
diff --git a/postgres/docker/entrypoint b/postgres/docker/entrypoint
index 1782d31..be591bc 100644
--- a/postgres/docker/entrypoint
+++ b/postgres/docker/entrypoint
@@ -2,16 +2,7 @@
set -e
+# This master password won't be known to anyone
export POSTGRES_PASSWORD=$(mktemp -u XXXXXXXXXXXXXXXX)
-kc_secret=/tmp/passwd/keycloak/secret
-{
- if [ ! -f ${kc_secret} ]; then
- mkdir -p $(dirname ${kc_secret})
- echo $(mktemp -u XXXXXXXXXXXXXXXX) >${kc_secret}
- fi
- chown root:postgres ${kc_secret}
- chmod 444 ${kc_secret}
-}
-
exec docker-entrypoint.sh "$@"