Release 1.21.1

If a user implements the user-auth-service trigger in a plugin and that plugin does not echo the passed in app(s) on stdout, the app is assumed to not exist. This mirrors the functionality for applications in regards to auth filtering.

This may still need auditing to ensure it covers everything and doesn't cause issues, but local testing implies that everything is working as expected.

Dockerfile

@@ -1 +1 @@
-FROM postgres:13.4
+FROM postgres:14.4

README.md

@@ -1,6 +1,6 @@
 # dokku postgres [![Build Status](https://img.shields.io/github/workflow/status/dokku/dokku-postgres/CI/master?style=flat-square "Build Status")](https://github.com/dokku/dokku-postgres/actions/workflows/ci.yml?query=branch%3Amaster) [![IRC Network](https://img.shields.io/badge/irc-libera-blue.svg?style=flat-square "IRC Libera")](https://webchat.libera.chat/?channels=dokku)
 
-Official postgres plugin for dokku. Currently defaults to installing [postgres 13.4](https://hub.docker.com/_/postgres/).
+Official postgres plugin for dokku. Currently defaults to installing [postgres 14.4](https://hub.docker.com/_/postgres/).
 
 ## Requirements
 
@@ -69,7 +69,7 @@ flags:
 - `-C|--custom-env "USER=alpha;HOST=beta"`: semi-colon delimited environment variables to start the service with
 - `-i|--image IMAGE`: the image name to start the service with
 - `-I|--image-version IMAGE_VERSION`: the image version to start the service with
-- `-m|--memory MEMORY`: container memory limit (default: unlimited)
+- `-m|--memory MEMORY`: container memory limit in megabytes (default: unlimited)
 - `-p|--password PASSWORD`: override the user-level service password
 - `-r|--root-password PASSWORD`: override the root-level service password
 - `-s|--shm-size SHM_SIZE`: override shared memory size for postgres docker container
@@ -478,7 +478,7 @@ flags:
 - `-C|--custom-env "USER=alpha;HOST=beta"`: semi-colon delimited environment variables to start the service with
 - `-i|--image IMAGE`: the image name to start the service with
 - `-I|--image-version IMAGE_VERSION`: the image version to start the service with
-- `-m|--memory MEMORY`: container memory limit (default: unlimited)
+- `-m|--memory MEMORY`: container memory limit in megabytes (default: unlimited)
 - `-p|--password PASSWORD`: override the user-level service password
 - `-r|--root-password PASSWORD`: override the root-level service password
 - `-s|--shm-size SHM_SIZE`: override shared memory size for postgres docker container

commands

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/config"
 [[ " help $PLUGIN_COMMAND_PREFIX:help $PLUGIN_COMMAND_PREFIX $PLUGIN_COMMAND_PREFIX:default " == *" $1 "* ]] || [[ "$1" == "$PLUGIN_COMMAND_PREFIX:"* ]] || exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
-source "$PLUGIN_BASE_PATH/common/functions"
+source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 set -eo pipefail
 [[ $DOKKU_TRACE ]] && set -x
 

common-functions

@@ -16,6 +16,64 @@ add_to_links_file() {
   sort "$LINKS_FILE" -u -o "$LINKS_FILE"
 }
 
+auth_service_filter() {
+  declare desc="calls user-service plugin trigger"
+  declare SERVICES=("$@")
+  local user_auth_count
+
+  if [[ "${#SERVICES[@]}" -eq 0 ]]; then
+    return
+  fi
+
+  user_auth_count="$(find "$PLUGIN_PATH"/enabled/*/user-auth-service 2>/dev/null | wc -l)"
+
+  # no plugin trigger exists
+  if [[ $user_auth_count == 0 ]]; then
+    # echo out all the services since there is no plugin trigger
+    for SERVICE in "${SERVICES[@]}"; do
+      [[ -n "$SERVICE" ]] && echo "$SERVICE"
+    done
+    return 0
+  fi
+
+  # this plugin trigger exists in the core `20_events` plugin
+  if [[ "$user_auth_count" == 1 ]] && [[ -f "$PLUGIN_PATH"/enabled/20_events/user-auth-service ]]; then
+  # echo out all the services since there is no valid plugin trigger
+    for SERVICE in "${SERVICES[@]}"; do
+      [[ -n "$SERVICE" ]] && echo "$SERVICE"
+    done
+    return 0
+  fi
+
+  export SSH_USER=${SSH_USER:=$USER}
+  export SSH_NAME=${NAME:="default"}
+  # the output of this trigger should be all the services a user has access to
+  plugn trigger user-auth-service "$SSH_USER" "$SSH_NAME" "${SERVICES[@]}"
+}
+
+fn-services-list() {
+  declare desc="prints a filtered list of all local apps"
+  declare FILTER="$1"
+  local detected_services filtered_services services
+
+  local detected_services=("$(ls "$PLUGIN_DATA_ROOT" 2>/dev/null)")
+  if [[ "$FILTER" == "false" ]]; then
+    for service in "${detected_services[@]}"; do
+      if [[ -n "$service" ]]; then 
+        echo "$service"
+      fi
+    done
+    return
+  fi
+
+  filtered_services="$(auth_service_filter "${detected_services[@]}" 2>/dev/null)"
+  for service in "$filtered_services"; do
+    if [[ -n "$service" ]]; then 
+      echo "$service"
+    fi
+  done
+}
+
 docker_ports_options() {
   declare desc="export a list of exposed ports"
   declare PORTS=("$@")
@@ -177,12 +235,15 @@ service_alternative_alias() {
 service_app_links() {
   declare desc="output all service links for a given app"
   declare APP="$1"
-  local SERVICE LINKED_APP
+  local LINKED_APP SERVICE SERVICE_ROOT
 
   pushd "$PLUGIN_DATA_ROOT" >/dev/null
-  for SERVICE in *; do
+  for SERVICE in $(fn-services-list); do
-    [[ -f "$SERVICE/LINKS" ]] || continue
+    [[ -n "$SERVICE" ]] || continue
-    for LINKED_APP in $(<"$SERVICE/LINKS"); do
+
+    SERVICE_ROOT="$PLUGIN_DATA_ROOT/$SERVICE"
+    [[ -f "$SERVICE_ROOT/LINKS" ]] || continue
+    for LINKED_APP in $(<"$SERVICE_ROOT/LINKS"); do
       if [[ "$LINKED_APP" == "$APP" ]]; then
         echo "$SERVICE"
       fi
@@ -411,6 +472,14 @@ service_enter() {
   docker exec $DOKKU_RUN_OPTS $ID $EXEC_CMD "${@:-/bin/bash}"
 }
 
+service_exists() {
+  declare desc="returns 0 or 1 depending on whether service exists or not"
+  declare SERVICE="$1"
+  [[ -z "$SERVICE" ]] && return 1
+  [[ -d "$PLUGIN_DATA_ROOT/$SERVICE" ]] && return 0
+  return 1
+}
+
 service_exposed_ports() {
   declare desc="list exposed ports for a service"
   declare SERVICE="$1"
@@ -567,16 +636,16 @@ service_links() {
 
 service_list() {
   declare desc="list all services and their status"
-  local SERVICES=$(ls "$PLUGIN_DATA_ROOT" 2>/dev/null)
 
-  if [[ -z $SERVICES ]]; then
+  services=("$(fn-services-list true)")
+  if [[ "${#services[@]}" -eq 0 ]] || [[ -z "$services" ]]; then
     dokku_log_warn "There are no $PLUGIN_SERVICE services"
     return
   fi
 
   dokku_log_info2_quiet "$PLUGIN_SERVICE services"
-  for SERVICE in $SERVICES; do
+  for service in "${services[@]}"; do
-    echo "$SERVICE"
+    echo "$service"
   done
 }
 
@@ -887,9 +956,21 @@ update_plugin_scheme_for_app() {
 
 verify_service_name() {
   declare desc="verify that a service exists"
-  declare SERVICE="$1"
+  declare SERVICE="$@"
-  [[ -z "$SERVICE" ]] && dokku_log_fail "(verify_service_name) SERVICE must not be null"
+
-  [[ ! -d "$PLUGIN_DATA_ROOT/$SERVICE" ]] && dokku_log_fail "$PLUGIN_SERVICE service $SERVICE does not exist"
+  if [[ -z "$SERVICE" ]]; then
+    dokku_log_fail "SERVICE must not be empty"
+  fi
+
+  if [[ ! -d "$PLUGIN_DATA_ROOT/$SERVICE" ]]; then
+    dokku_log_fail "$PLUGIN_SERVICE service $SERVICE does not exist"
+  fi
+
+  SERVICE="$(auth_service_filter "$SERVICE")"
+  if [[ -z "$SERVICE" ]]; then
+    dokku_log_fail "$PLUGIN_SERVICE service $SERVICE does not exist"
+  fi
+
   return 0
 }
 

functions

@@ -3,7 +3,7 @@ source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/config"
 set -eo pipefail
 [[ $DOKKU_TRACE ]] && set -x
 source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/common-functions"
-source "$PLUGIN_BASE_PATH/common/functions"
+source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 source "$PLUGIN_AVAILABLE_PATH/config/functions"
 if [[ -f "$PLUGIN_AVAILABLE_PATH/docker-options/functions" ]]; then
   source "$PLUGIN_AVAILABLE_PATH/docker-options/functions"

install

@@ -24,10 +24,10 @@ plugin-install() {
   pull-docker-image "$PLUGIN_WAIT_IMAGE"
 
   mkdir -p "$PLUGIN_DATA_ROOT" || echo "Failed to create $PLUGIN_SERVICE data directory"
-  chown dokku:dokku "$PLUGIN_DATA_ROOT"
+  chown "${DOKKU_SYSTEM_USER}:${DOKKU_SYSTEM_GROUP}" "$PLUGIN_DATA_ROOT"
 
   mkdir -p "$PLUGIN_CONFIG_ROOT" || echo "Failed to create $PLUGIN_SERVICE config directory"
-  chown dokku:dokku "$PLUGIN_CONFIG_ROOT"
+  chown "${DOKKU_SYSTEM_USER}:${DOKKU_SYSTEM_GROUP}" "$PLUGIN_CONFIG_ROOT"
 
   rm -f "/etc/sudoers.d/dokku-${PLUGIN_COMMAND_PREFIX}*"
   _SUDOERS_FILE="/etc/sudoers.d/dokku-${PLUGIN_COMMAND_PREFIX}"
@@ -44,8 +44,7 @@ EOL
 
   chmod 0440 "$_SUDOERS_FILE"
 
-  local SERVICES=$(ls "$PLUGIN_DATA_ROOT" 2>/dev/null)
+  for SERVICE in $(fn-services-list false); do
-  for SERVICE in $SERVICES; do
     local SERVICE_ROOT="$PLUGIN_DATA_ROOT/$SERVICE"
 
     if [[ ! -f "$SERVICE_ROOT/IMAGE" ]] || [[ ! -f "$SERVICE_ROOT/IMAGE_VERSION" ]]; then
@@ -56,8 +55,11 @@ EOL
       fi
     fi
 
+    chown "${DOKKU_SYSTEM_USER}:${DOKKU_SYSTEM_GROUP}" "$SERVICE_ROOT/IMAGE" "$SERVICE_ROOT/IMAGE_VERSION"
+
     if [[ -f "$SERVICE_ROOT/${PLUGIN_VARIABLE}_CONFIG_OPTIONS" ]]; then
       mv "$SERVICE_ROOT/${PLUGIN_VARIABLE}_CONFIG_OPTIONS" "$SERVICE_ROOT/CONFIG_OPTIONS"
+      chown "${DOKKU_SYSTEM_USER}:${DOKKU_SYSTEM_GROUP}" "$SERVICE_ROOT/CONFIG_OPTIONS"
     fi
   done
 }

plugin.toml

@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku postgres service plugin"
-version = "1.18.0"
+version = "1.21.1"
 [plugin.config]

post-app-clone-setup

@@ -8,8 +8,7 @@ set -eo pipefail
 plugin-post-app-clone-setup() {
   declare OLD_APP_NAME="$1" NEW_APP_NAME="$2"
 
-  local SERVICES=$(ls "$PLUGIN_DATA_ROOT" 2>/dev/null)
+  for SERVICE in $(fn-services-list false); do
-  for SERVICE in $SERVICES; do
     if in_links_file "$SERVICE" "$OLD_APP_NAME"; then
       add_to_links_file "$SERVICE" "$NEW_APP_NAME"
     fi

post-app-rename-setup

@@ -8,8 +8,7 @@ set -eo pipefail
 plugin-post-app-rename-setup() {
   declare OLD_APP_NAME="$1" NEW_APP_NAME="$2"
 
-  local SERVICES=$(ls "$PLUGIN_DATA_ROOT" 2>/dev/null)
+  for SERVICE in $(fn-services-list false); do
-  for SERVICE in $SERVICES; do
     if in_links_file "$SERVICE" "$OLD_APP_NAME"; then
       add_to_links_file "$SERVICE" "$NEW_APP_NAME"
     fi

pre-delete

@@ -1,21 +1,13 @@
 #!/usr/bin/env bash
+source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/config"
-source "$PLUGIN_BASE_PATH/common/functions"
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/functions"
 set -eo pipefail
 [[ $DOKKU_TRACE ]] && set -x
 
-PLUGIN_BASE_PATH="$PLUGIN_PATH"
-if [[ -n $DOKKU_API_VERSION ]]; then
-  PLUGIN_BASE_PATH="$PLUGIN_ENABLED_PATH"
-fi
-source "$PLUGIN_BASE_PATH/common/functions"
-source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/functions"
-
 APP="$1"
-pushd "$PLUGIN_DATA_ROOT" >/dev/null
+for SERVICE in $(fn-services-list false); do
-for SERVICE in *; do
+  [[ -n "$SERVICE" ]] || continue
   dokku_log_verbose_quiet "Unlinking from $SERVICE"
   remove_from_links_file "$(basename "$SERVICE")" "$APP"
 done
-popd >/dev/null 2>&1 || pushd "/tmp" >/dev/null
-exit 0

pre-restore

@@ -7,18 +7,18 @@ set -eo pipefail
 
 plugin-pre-restore() {
   declare SCHEDULER="$1" APP="$2"
+  local status
 
   if [[ "$SCHEDULER" != "docker-local" ]]; then
     return
   fi
 
-  local SERVICES=$(ls "$PLUGIN_DATA_ROOT" 2>/dev/null)
+  for SERVICE in $(fn-services-list false); do
-  for SERVICE in $SERVICES; do
     if ! in_links_file "$SERVICE" "$APP"; then
       continue
     fi
 
-    local status="$(service_status "$SERVICE")"
+    status="$(service_status "$SERVICE")"
     if [[ "$status" == "running" ]]; then
       continue
     fi

pre-start

@@ -7,14 +7,14 @@ set -eo pipefail
 
 plugin-pre-start() {
   declare APP="$1"
+  local status
 
-  local SERVICES=$(ls "$PLUGIN_DATA_ROOT" 2>/dev/null)
+  for SERVICE in $(fn-services-list false); do
-  for SERVICE in $SERVICES; do
     if ! in_links_file "$SERVICE" "$APP"; then
       continue
     fi
 
-    local status="$(service_status "$SERVICE")"
+    status="$(service_status "$SERVICE")"
     if [[ "$status" == "running" ]]; then
       continue
     fi

scripts/enable_ssl.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 pushd /var/lib/postgresql/data >/dev/null
-openssl req -new -newkey rsa:4096 -x509 -nodes -out server.crt -keyout server.key -batch
+openssl req -new -newkey rsa:4096 -x509 -days 365000 -nodes -out server.crt -keyout server.key -batch
 chmod 600 server.key
 sed -i "s/^#ssl = off/ssl = on/" postgresql.conf
 sed -i "s/^#ssl_ciphers =.*/ssl_ciphers = 'AES256+EECDH:AES256+EDH'/" postgresql.conf

subcommands/clone

@@ -14,7 +14,7 @@ service-clone-cmd() {
   #F -C|--custom-env "USER=alpha;HOST=beta", semi-colon delimited environment variables to start the service with
   #F -i|--image IMAGE, the image name to start the service with
   #F -I|--image-version IMAGE_VERSION, the image version to start the service with
-  #F -m|--memory MEMORY, container memory limit (default: unlimited)
+  #F -m|--memory MEMORY, container memory limit in megabytes (default: unlimited)
   #F -p|--password PASSWORD, override the user-level service password
   #F -r|--root-password PASSWORD, override the root-level service password
   #F -s|--shm-size SHM_SIZE, override shared memory size for $PLUGIN_COMMAND_PREFIX docker container
@@ -27,6 +27,9 @@ service-clone-cmd() {
   [[ -z "$SERVICE" ]] && dokku_log_fail "Please specify a valid name for the service"
   [[ -z "$NEW_SERVICE" ]] && dokku_log_fail "Please specify a name for the new service"
   verify_service_name "$SERVICE"
+  if service_exists "$NEW_SERVICE"; then
+    dokku_log_fail "Invalid service name $NEW_SERVICE. Verify the service name is not already in use."
+  fi
 
   local SERVICE_ROOT="$PLUGIN_DATA_ROOT/$SERVICE"
   local ID="$(cat "$SERVICE_ROOT/ID")"

subcommands/create

@@ -22,7 +22,7 @@ service-create-cmd() {
   #F -C|--custom-env "USER=alpha;HOST=beta", semi-colon delimited environment variables to start the service with
   #F -i|--image IMAGE, the image name to start the service with
   #F -I|--image-version IMAGE_VERSION, the image version to start the service with
-  #F -m|--memory MEMORY, container memory limit (default: unlimited)
+  #F -m|--memory MEMORY, container memory limit in megabytes (default: unlimited)
   #F -p|--password PASSWORD, override the user-level service password
   #F -r|--root-password PASSWORD, override the root-level service password
   #F -s|--shm-size SHM_SIZE, override shared memory size for $PLUGIN_COMMAND_PREFIX docker container

subcommands/enter

@@ -20,6 +20,7 @@ service-enter-cmd() {
   declare SERVICE="$1"
 
   dokku_log_info1_quiet "Filesystem changes may not persist after container restarts"
+  verify_service_name "$SERVICE"
   service_enter "$SERVICE" "${@:2}"
 }