Enabling SSL for PostgreSQL in Docker
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/bin/bash | |
set -euo pipefail | |
openssl req -new -text -passout pass:abcd -subj /CN=localhost -out server.req -keyout privkey.pem | |
openssl rsa -in privkey.pem -passin pass:abcd -out server.key | |
openssl req -x509 -in server.req -text -key server.key -out server.crt | |
chmod 600 server.key | |
test $(uname -s) = Linux && chown 70 server.key | |
docker run -d --name postgres -e POSTGRES_HOST_AUTH_METHOD=trust -v "$(pwd)/server.crt:/var/lib/postgresql/server.crt:ro" -v "$(pwd)/server.key:/var/lib/postgresql/server.key:ro" postgres:12-alpine -c ssl=on -c ssl_cert_file=/var/lib/postgresql/server.crt -c ssl_key_file=/var/lib/postgresql/server.key | |
sleep 1 | |
docker run --rm -it --link postgres postgres:12-alpine psql -h postgres -U postgres |
@suikast42 Yes, that's true. The self-signed cert that you created in this script will expire after a month. The CA server can renew the certificate. For the CA, you can set up smallstep/certificates open source CA server, or sign up for a hosted CA (it's free for small homelabs).
@suikast42 Yes, that's true. The self-signed cert that you created in this script will expire after a month. The CA server can renew the certificate. For the CA, you can set up smallstep/certificates open source CA server, or sign up for a hosted CA (it's free for small homelabs).
Look like cert-manager outside of k8s. Looking good.
@Istellway you are a savior. Thank you!
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
That's looking very well. As I unterstand, this setup needs a external PKI server, right ?