LokiStack/docker-entrypoint.sh

#!/bin/bash
# ============================================================
# lokistack Secure Entrypoint
# ============================================================
# Enforces required secrets at container startup
# Supports Docker Secrets file-based injection
# ============================================================
set -e

# ---- Docker Secrets support ----
# If *_FILE is provided, read the secret from that file path
# (Docker Swarm / Docker Compose secrets)
if [ -n "${JWT_SECRET_FILE:-}" ] && [ -r "$JWT_SECRET_FILE" ]; then
    JWT_SECRET=$(cat "$JWT_SECRET_FILE")
    export JWT_SECRET
fi

if [ -n "${ENCRYPTION_KEY_FILE:-}" ] && [ -r "$ENCRYPTION_KEY_FILE" ]; then
    ENCRYPTION_KEY=$(cat "$ENCRYPTION_KEY_FILE")
    export ENCRYPTION_KEY
fi

# ---- 零输入启动:未显式提供密钥时自动生成并持久化到数据卷 ----
# docker compose up -d 即可启动;生成的密钥保存在 $DATA_DIR/.secrets.env
# (0600),重启/升级不变。需要固定密钥或接入密钥管理时,显式设置环境变量即可覆盖。
AUTO_SECRETS_FILE="${DATA_DIR:-/app/data}/.secrets.env"
if [ -z "${JWT_SECRET:-}" ] || [ -z "${ENCRYPTION_KEY:-}" ]; then
    # 先保存显式传入的值:source 持久化文件时不能覆盖用户显式配置
    EXPLICIT_JWT="${JWT_SECRET:-}"
    EXPLICIT_ENC="${ENCRYPTION_KEY:-}"
    if [ -r "$AUTO_SECRETS_FILE" ]; then
        # shellcheck disable=SC1090
        . "$AUTO_SECRETS_FILE"
    fi
    [ -n "$EXPLICIT_JWT" ] && JWT_SECRET="$EXPLICIT_JWT"
    [ -n "$EXPLICIT_ENC" ] && ENCRYPTION_KEY="$EXPLICIT_ENC"
    CHANGED=0
    gen_secret() { head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n'; }
    if [ -z "${JWT_SECRET:-}" ]; then
        JWT_SECRET="$(gen_secret)"
        CHANGED=1
        echo "==> JWT_SECRET not provided; generated and persisted to $AUTO_SECRETS_FILE"
    fi
    if [ -z "${ENCRYPTION_KEY:-}" ]; then
        ENCRYPTION_KEY="$(gen_secret)"
        CHANGED=1
        echo "==> ENCRYPTION_KEY not provided; generated and persisted to $AUTO_SECRETS_FILE"
    fi
    export JWT_SECRET ENCRYPTION_KEY
    if [ "$CHANGED" = "1" ]; then
        umask 077
        {
            echo "# Auto-generated by lokistack entrypoint. Remove to regenerate."
            echo "JWT_SECRET=$JWT_SECRET"
            echo "ENCRYPTION_KEY=$ENCRYPTION_KEY"
        } > "$AUTO_SECRETS_FILE"
    fi
fi

# ---- Runtime security validation ----
MISSING_VARS=()

# P0: JWT_SECRET must be provided at runtime
if [ -z "${JWT_SECRET:-}" ]; then
    MISSING_VARS+=("JWT_SECRET")
fi

# P0: ENCRYPTION_KEY must be provided at runtime for AES credential encryption
if [ -z "${ENCRYPTION_KEY:-}" ]; then
    MISSING_VARS+=("ENCRYPTION_KEY")
fi

if [ ${#MISSING_VARS[@]} -ne 0 ]; then
    echo "============================================================" >&2
    echo "FATAL: Missing required security environment variables" >&2
    echo "============================================================" >&2
    for var in "${MISSING_VARS[@]}"; do
        echo "  - $var" >&2
    done
    echo "" >&2
    echo "These MUST be provided at runtime. Examples:" >&2
    echo "" >&2
    echo '  docker run -e JWT_SECRET="$(openssl rand -hex 32)" -e ENCRYPTION_KEY="$(openssl rand -hex 32)" lokistack' >&2
    echo "" >&2
    echo "Or via docker-compose secrets (recommended for production):" >&2
    echo '  secrets:' >&2
    echo '    - jwt_secret' >&2
    echo '    - encryption_key' >&2
    echo '  environment:' >&2
    echo '    JWT_SECRET_FILE: /run/secrets/jwt_secret' >&2
    echo '    ENCRYPTION_KEY_FILE: /run/secrets/encryption_key' >&2
    echo "============================================================" >&2
    exit 1
fi

# ---- Validate JWT_SECRET strength ----
SECRET_LEN=${#JWT_SECRET}
if [ "$SECRET_LEN" -lt 32 ]; then
    echo "WARNING: JWT_SECRET should be at least 32 characters long (current: $SECRET_LEN)" >&2
    echo "  Generate with: openssl rand -hex 32" >&2
fi

# ---- Validate ENCRYPTION_KEY strength ----
# config.go 在 ENCRYPTION_KEY < 32 字符时会 log.Fatal 拒绝启动；
# 此处前置硬校验，避免容器进入"entrypoint 通过但 Go 进程崩溃"的死循环。
KEY_LEN=${#ENCRYPTION_KEY}
if [ "$KEY_LEN" -lt 32 ]; then
    echo "============================================================" >&2
    echo "FATAL: ENCRYPTION_KEY must be at least 32 characters (current: $KEY_LEN)" >&2
    echo "  Generate with: openssl rand -hex 32" >&2
    echo "============================================================" >&2
    exit 1
fi

# ---- Signal handling for graceful shutdown ----
# Forward signals to the application
shutdown() {
    echo "Entrypoint received shutdown signal, forwarding to application..."
    kill -TERM "$child" 2>/dev/null || true
    wait "$child" 2>/dev/null || true
    exit 0
}
trap shutdown SIGTERM SIGINT

echo "lokistack starting with security configuration OK"
echo "Data directory: ${DATA_DIR}"
echo "Server port: ${SERVER_PORT}"

# ---- Start the main application ----
# Use exec to properly forward signals, but wrap with background + wait
# so this script's trap handler can intercept signals
"$@" &
child=$!
wait "$child"