25 lines
1.2 KiB
Bash
25 lines
1.2 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
case "$S3_BUCKET" in *[!a-z0-9.-]*|'') echo 'Invalid local bucket name' >&2; exit 1;; esac
|
|
if [ "$MINIO_ROOT_USER" = "$S3_APP_USER" ]; then echo 'Runtime storage user must not be root' >&2; exit 1; fi
|
|
# Disposable local secrets are passed via environment, never traced/logged.
|
|
mc alias set local http://storage:9000 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD" >/dev/null
|
|
mc mb --ignore-existing "local/$S3_BUCKET" >/dev/null
|
|
mc anonymous set none "local/$S3_BUCKET" >/dev/null
|
|
mc admin user add local "$S3_APP_USER" "$S3_APP_PASSWORD" >/dev/null
|
|
# Use shell builtins only: the minimal MinIO image does not ship sed/cat.
|
|
policy=''
|
|
while IFS= read -r line || [ -n "$line" ]; do
|
|
while [ "${line#*dtf-local-artwork}" != "$line" ]; do
|
|
policy="$policy${line%%dtf-local-artwork*}$S3_BUCKET"
|
|
line=${line#*dtf-local-artwork}
|
|
done
|
|
policy="$policy$line
|
|
"
|
|
done < /policy.json
|
|
printf '%s' "$policy" > /tmp/policy.json
|
|
mc admin policy create local dtf-artwork /tmp/policy.json >/dev/null
|
|
mc admin policy attach local dtf-artwork --user "$S3_APP_USER" >/dev/null
|
|
mc ilm import "local/$S3_BUCKET" < /lifecycle.json
|
|
echo 'Local storage runtime account provisioned.'
|