Mercurial > lada > lada-server
comparison db_schema/Dockerfile @ 1161:ea6b062e5305 pgaudit
Use pgaudit to generate an audit trail.
Upgrade to PostgreSQL 9.5 because it is a requirement for pgaudit.
pgaudit/analyze can be used to transfer the audit trail into the
database, but it seems to be easy to do this with pgaudit directly
with some changes to the code.
| author | Tom Gottfried <tom@intevation.de> |
|---|---|
| date | Tue, 08 Nov 2016 19:21:24 +0100 |
| parents | 259a6b638968 |
| children | e0a959e652c4 |
comparison
equal
deleted
inserted
replaced
| 1160:5d2c68a4c344 | 1161:ea6b062e5305 |
|---|---|
| 1 # Docker file for postgresql 9.4 on debain | 1 # Docker file for the LADA database on Debian |
| 2 # | 2 # |
| 3 # build with e.g. `docker build --force-rm=true -t koala/lada_db .', | 3 # build with e.g. `docker build --force-rm=true -t koala/lada_db .', |
| 4 # then run with e.g. | 4 # then run with e.g. |
| 5 # `docker run --name lada_db -dp 2345:5432 koala/lada_db:latest' | 5 # `docker run --name lada_db -dp 2345:5432 koala/lada_db:latest' |
| 6 # | 6 # |
| 26 | 26 |
| 27 # | 27 # |
| 28 # Install packages | 28 # Install packages |
| 29 # | 29 # |
| 30 RUN apt-get update && \ | 30 RUN apt-get update && \ |
| 31 apt-get install -y postgresql-9.4-postgis-2.1 postgis curl unzip | 31 apt-get install -y curl unzip make gcc |
| 32 RUN echo "deb http://apt.postgresql.org/pub/repos/apt/ jessie-pgdg main" \ | |
| 33 >> /etc/apt/sources.list | |
| 34 RUN curl https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add - | |
| 35 RUN apt-get update && \ | |
| 36 apt-get install -y --no-install-recommends \ | |
| 37 postgresql-9.5-postgis-2.3 postgresql-9.5-postgis-scripts postgis \ | |
| 38 postgresql-server-dev-9.5 \ | |
| 39 libdbi-perl libdbd-pg-perl # for pgaudit/analyze | |
| 40 | |
| 41 # | |
| 42 # Add context as working directory | |
| 43 # | |
| 44 ADD . /opt/lada_sql/ | |
| 45 WORKDIR /opt/lada_sql/ | |
| 46 | |
| 47 # | |
| 48 # Set environment variables | |
| 49 # | |
| 50 ENV PGCONF /etc/postgresql/9.5/main/postgresql.conf | |
| 51 ENV PGDATA /var/lib/postgresql/9.5/main | |
| 52 | |
| 53 # | |
| 54 # Install pgaudit | |
| 55 # | |
| 56 # run `git clone https://github.com/pgaudit/pgaudit.git' within context | |
| 57 # before building image! | |
| 58 RUN sed -i '/^USE_PGXS/b;1iUSE_PGXS = yes' pgaudit/Makefile | |
| 59 RUN cd pgaudit && make install | |
| 60 RUN echo "shared_preload_libraries = 'pgaudit'" >> $PGCONF | |
| 32 | 61 |
| 33 # | 62 # |
| 34 # Use user postgres to run the next commands | 63 # Use user postgres to run the next commands |
| 35 # | 64 # |
| 36 USER postgres | 65 USER postgres |
| 41 # | 70 # |
| 42 # Adjust PostgreSQL configuration so that remote connections to the | 71 # Adjust PostgreSQL configuration so that remote connections to the |
| 43 # database are possible. | 72 # database are possible. |
| 44 # | 73 # |
| 45 RUN echo "host all all 0.0.0.0/0 md5" >> \ | 74 RUN echo "host all all 0.0.0.0/0 md5" >> \ |
| 46 /etc/postgresql/9.4/main/pg_hba.conf | 75 /etc/postgresql/9.5/main/pg_hba.conf |
| 76 RUN echo "listen_addresses='*'" >> $PGCONF | |
| 47 | 77 |
| 48 RUN echo "listen_addresses='*'" >> /etc/postgresql/9.4/main/postgresql.conf | 78 # |
| 79 # Configure logging collector | |
| 80 # (because we use postgres directly in CMD, | |
| 81 # the usual collection from stderr does not work) | |
| 82 # | |
| 83 RUN echo "logging_collector = on" >> $PGCONF | |
| 84 RUN echo "log_directory = '/var/log/postgresql'" >> $PGCONF | |
| 85 #RUN echo "log_filename = 'postgresql-9.5-main.log'" >> $PGCONF | |
| 86 # for pgaudit/analyze | |
| 87 RUN echo "log_filename = '%F'" >> $PGCONF | |
| 88 RUN echo "log_destination = 'csvlog'" >> $PGCONF | |
| 89 RUN echo "log_connections = on" >> $PGCONF | |
| 49 | 90 |
| 50 # | 91 # |
| 51 # Expose the PostgreSQL port | 92 # Expose the PostgreSQL port |
| 52 # | 93 # |
| 53 EXPOSE 5432 | 94 EXPOSE 5432 |
| 57 # | 98 # |
| 58 # Don't mind scary messages like | 99 # Don't mind scary messages like |
| 59 # 'FATAL: the database system is starting up'. | 100 # 'FATAL: the database system is starting up'. |
| 60 # It's because of the -w | 101 # It's because of the -w |
| 61 # | 102 # |
| 62 ADD . /opt/lada_sql/ | 103 RUN /usr/lib/postgresql/9.5/bin/pg_ctl start -wo "--config_file=$PGCONF" && \ |
| 63 WORKDIR /opt/lada_sql/ | 104 /opt/lada_sql/setup-db.sh && \ |
| 64 | 105 /usr/lib/postgresql/9.5/bin/pg_ctl stop |
| 65 RUN /usr/lib/postgresql/9.4/bin/pg_ctl start -wD /etc/postgresql/9.4/main/ && \ | |
| 66 /opt/lada_sql/setup-db.sh | |
| 67 | 106 |
| 68 # | 107 # |
| 69 # Set the default command to run when starting the container | 108 # Set the default command to run when starting the container |
| 70 # | 109 # |
| 71 CMD ["/usr/lib/postgresql/9.4/bin/postgres", "-D", \ | 110 CMD ["/usr/lib/postgresql/9.5/bin/postgres", \ |
| 72 "/var/lib/postgresql/9.4/main", "-c", \ | 111 "--config_file=/etc/postgresql/9.5/main/postgresql.conf"] |
| 73 "config_file=/etc/postgresql/9.4/main/postgresql.conf"] | 112 |
| 113 # To use pgaudit/analyze from within the container: | |
| 114 # cd pgaudit/analyze/bin | |
| 115 # ./pgaudit_analyze /var/log/postgresql/ \ | |
| 116 # --log-file /var/log/postgresql/pgaudit_analyze.log |