fix(deploy): validate session migrator TLS mode

2026-07-16 19:07:53 +02:00
parent cadc4c6947
commit 7a65fc80a2
6 changed files with 96 additions and 8 deletions
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root=$(cd "$(dirname "$0")/.." && pwd)
+helper="$root/docker/session-migrate.sh"
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT HUP INT TERM
+
+if THT_SESSION_DB_SSLMODE=prefer sh "$helper" >"$tmp/invalid.out" 2>&1; then
+  echo "session migrator accepted an unverified TLS mode" >&2
+  exit 1
+fi
+grep -qx 'THT_SESSION_DB_SSLMODE must be verify-ca or verify-full' "$tmp/invalid.out"
+
+printf '%s' password >"$tmp/password"
+cat >"$tmp/tht" <<'EOF'
+#!/bin/sh
+printf '%s\n' "$@" >"$ARGS_FILE"
+EOF
+chmod +x "$tmp/tht"
+
+ARGS_FILE="$tmp/args" \
+THT_BIN="$tmp/tht" \
+THT_SESSION_DB_HOST=sessions-db.internal \
+THT_SESSION_DB_PORT=5432 \
+THT_SESSION_DB_NAME=thoth \
+THT_SESSION_MIGRATOR_USER=thoth_sessions_migrate \
+THT_SESSION_MIGRATOR_PASSWORD_FILE="$tmp/password" \
+THT_SESSION_DB_SSLMODE=verify-full \
+THT_SESSION_DB_SSLROOTCERT=/run/secrets/session_ca.pem \
+sh "$helper"
+
+grep -qx 'session' "$tmp/args"
+grep -qx 'migrate' "$tmp/args"
+grep -qx -- '--database-url' "$tmp/args"
+grep -Fxq 'postgresql+psycopg2://thoth_sessions_migrate@sessions-db.internal:5432/thoth?sslmode=verify-full&sslrootcert=/run/secrets/session_ca.pem' "$tmp/args"
+
+echo "session migrator TLS contract passed."