typelevel / typelevel/skunk

Docker Postgres SSL Failure

Open
#547 1 comment 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Scala
Stars
1.7k
Forks
175
Avg merge
5d 14h
Merged PRs (30d)
9

Description

This is likely only an issue for my dev setup but I mentioned the issue in chat and wanted to follow up here in the event anyone else runs into this.

Running ./bin/local up yields this error in the docker logs:

postgres_1  | waiting for server to start....2021-09-14 15:06:37.333 UTC [47] FATAL:  private key file "/var/lib/postgresql/server.key" must be owned by the database user or root
postgres_1  | 2021-09-14 15:06:37.333 UTC [47] LOG:  database system is shut down
postgres_1  |  stopped waiting
postgres_1  | pg_ctl: could not start server

To get around this I modified the docker-compose.yml file to look like:

version: '3'
services:
  # main instance for testing
  postgres:
    image: postgres:11
    # Fails on my setup
    # command: -c ssl=on -c ssl_cert_file=/var/lib/postgresql/server.crt -c ssl_key_file=/var/lib/postgresql/server.key
    volumes:
      - ./world/world.sql:/docker-entrypoint-initdb.d/world.sql
      - ./world/server.crt:/var/lib/postgresql/server.crt
      - ./world/server.key:/var/lib/postgresql/server.key
    ports:
      - 5432:5432
    environment:
      POSTGRES_USER: jimmy
      POSTGRES_PASSWORD: banana
      POSTGRES_DB: world
    # Added to overcome server.crt permission issue
    entrypoint: >
        /bin/sh -c "chmod 0600 /var/lib/postgresql/server.key &&
        chown postgres:postgres /var/lib/postgresql/server.key &&
        docker-entrypoint.sh -c ssl=on -c ssl_cert_file=/var/lib/postgresql/server.crt -c ssl_key_file=/var/lib/postgresql/server.key"
...

This was enough to get the JVM tests to pass for me, although the JS SSL-enabled test still failed.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with docker-compose.yml and the ./bin/local up entry point, then reproduce the PostgreSQL SSL startup failure from the logs. Check the JVM and JS SSL-enabled tests; done means the database starts with SSL enabled and both test paths pass.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, docker-compose, postgresql
Domain
databases, devops, testing
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.