52 lines
1.9 KiB
Bash
Executable file
52 lines
1.9 KiB
Bash
Executable file
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
# This wrapper is installed only into the GCP service's root-controlled bind.
|
|
# Ignore per-invocation mode and endpoint overrides so a service child cannot
|
|
# select the VPS/local backend or a different database credential context.
|
|
SCRIPT_PATH=${BASH_SOURCE[0]}
|
|
SCRIPT_DIR=${SCRIPT_PATH%/*}
|
|
if [ "$SCRIPT_DIR" = "$SCRIPT_PATH" ]; then
|
|
SCRIPT_DIR=.
|
|
fi
|
|
SCRIPT_DIR="$(cd "$SCRIPT_DIR" && pwd)"
|
|
CLOUDSQL_TOOL="$SCRIPT_DIR/cloudsql_memory_tool.py"
|
|
|
|
for argument in "$@"; do
|
|
case "$argument" in
|
|
--host|--host=*|--port|--port=*|--db|--db=*|--canonical-db|--canonical-db=*|\
|
|
--user|--user=*|--password-secret|--password-secret=*|--project|--project=*|\
|
|
--credential-mode|--credential-mode=*)
|
|
echo "teleo-kb: GCP runtime identity and endpoint overrides are forbidden" >&2
|
|
exit 64
|
|
;;
|
|
esac
|
|
done
|
|
|
|
if [ ! -x "$CLOUDSQL_TOOL" ]; then
|
|
echo "teleo-kb: reviewed GCP Cloud SQL tool is unavailable" >&2
|
|
exit 69
|
|
fi
|
|
if [ ! -x /usr/bin/python3 ] || [ ! -x /usr/bin/psql ]; then
|
|
echo "teleo-kb: required GCP runtime dependency is unavailable" >&2
|
|
exit 69
|
|
fi
|
|
|
|
exec /usr/bin/env -i \
|
|
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
|
|
LANG=C LC_ALL=C \
|
|
PYTHONNOUSERSITE=1 PYTHONSAFEPATH=1 \
|
|
CLOUDSDK_CONFIG=/usr/local/libexec/livingip/leoclean-kb/gcloud-config \
|
|
PGSSLMODE=verify-ca \
|
|
PGSSLROOTCERT=/usr/local/libexec/livingip/leoclean-kb/cloudsql-server-ca.pem \
|
|
TELEO_KB_MODE=cloudsql \
|
|
TELEO_GCP_METADATA_ONLY=1 \
|
|
TELEO_GCP_PROJECT=teleo-501523 \
|
|
TELEO_CLOUDSQL_HOST=10.61.0.3 \
|
|
TELEO_CLOUDSQL_PORT=5432 \
|
|
TELEO_CLOUDSQL_DB=teleo_canonical \
|
|
TELEO_CANONICAL_CLOUDSQL_DB=teleo_canonical \
|
|
TELEO_CLOUDSQL_USER=leoclean_kb_runtime \
|
|
TELEO_CLOUDSQL_PASSWORD_SECRET=gcp-teleo-pgvector-standby-leoclean-kb-runtime-password \
|
|
TELEO_CLOUDSQL_ENABLE_AUDIT_FALLBACK=0 \
|
|
/usr/bin/python3 -I "$CLOUDSQL_TOOL" "$@"
|