Initial commit

init/minio-bootstrap.sh

@@ -0,0 +1,56 @@
+#!/bin/sh
+# Idempotent MinIO bootstrap: bucket + per-app service account scoped to that
+# bucket. Re-running just refreshes the policy and resets the access key.
+set -eu
+
+mc alias set local http://minio:9000 "${MINIO_ROOT_USER}" "${MINIO_ROOT_PASSWORD}"
+
+ensure_bucket() {
+  bucket="$1"
+  if ! mc ls "local/${bucket}" >/dev/null 2>&1; then
+    mc mb "local/${bucket}"
+  fi
+  mc anonymous set none "local/${bucket}" >/dev/null
+}
+
+write_policy() {
+  name="$1"
+  bucket="$2"
+  cat > "/tmp/${name}.json" <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": ["s3:ListBucket", "s3:GetBucketLocation"],
+      "Resource": ["arn:aws:s3:::${bucket}"]
+    },
+    {
+      "Effect": "Allow",
+      "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
+      "Resource": ["arn:aws:s3:::${bucket}/*"]
+    }
+  ]
+}
+EOF
+  mc admin policy create local "${name}" "/tmp/${name}.json" 2>/dev/null \
+    || mc admin policy update local "${name}" "/tmp/${name}.json"
+}
+
+ensure_user() {
+  access="$1"
+  secret="$2"
+  policy="$3"
+  if mc admin user info local "${access}" >/dev/null 2>&1; then
+    # Rotate secret to match desired state.
+    mc admin user remove local "${access}" >/dev/null
+  fi
+  mc admin user add local "${access}" "${secret}"
+  mc admin policy attach local "${policy}" --user "${access}" 2>/dev/null || true
+}
+
+ensure_bucket "asxpio-invoices"
+write_policy  "asxpio-invoices-rw" "asxpio-invoices"
+ensure_user   "${ASXPIO_S3_ACCESS_KEY}" "${ASXPIO_S3_SECRET_KEY}" "asxpio-invoices-rw"
+
+echo "minio-init: done"

init/postgres-init.sh

@@ -0,0 +1,29 @@
+#!/bin/sh
+# Idempotent bootstrap: create per-app roles and databases.
+# Re-running is safe — checks before creating, updates passwords if changed.
+set -eu
+
+ensure_role() {
+  role="$1"
+  password="$2"
+  exists=$(psql -tAc "SELECT 1 FROM pg_roles WHERE rolname='${role}'")
+  if [ "${exists}" = "1" ]; then
+    psql -c "ALTER ROLE \"${role}\" WITH LOGIN PASSWORD '${password}';"
+  else
+    psql -c "CREATE ROLE \"${role}\" WITH LOGIN PASSWORD '${password}';"
+  fi
+}
+
+ensure_db() {
+  db="$1"
+  owner="$2"
+  exists=$(psql -tAc "SELECT 1 FROM pg_database WHERE datname='${db}'")
+  if [ "${exists}" != "1" ]; then
+    psql -c "CREATE DATABASE \"${db}\" OWNER \"${owner}\";"
+  fi
+}
+
+ensure_role "asxpio" "${ASXPIO_DB_PASSWORD}"
+ensure_db   "asxpio" "asxpio"
+
+echo "postgres-init: done"