54 lines
3.2 KiB
Bash
Executable File
54 lines
3.2 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
: "${MYSQL_ACCESS_BROKER_USER:?MYSQL_ACCESS_BROKER_USER is required}"
|
|
: "${MYSQL_ACCESS_BROKER_PASSWORD:?MYSQL_ACCESS_BROKER_PASSWORD is required}"
|
|
: "${MYSQL_USER:?MYSQL_USER is required}"
|
|
: "${MYSQL_PASSWORD:?MYSQL_PASSWORD is required}"
|
|
|
|
if ! printf '%s' "${MYSQL_ACCESS_BROKER_USER}" | grep -Eq '^[A-Za-z][A-Za-z0-9_]{0,31}$'; then
|
|
echo "MYSQL_ACCESS_BROKER_USER must be a safe MySQL account name" >&2
|
|
exit 1
|
|
fi
|
|
if ! printf '%s' "${MYSQL_USER}" | grep -Eq '^[A-Za-z][A-Za-z0-9_]{0,31}$'; then
|
|
echo "MYSQL_USER must be a safe MySQL account name" >&2
|
|
exit 1
|
|
fi
|
|
if [ "${MYSQL_ACCESS_BROKER_USER}" = "root" ] || [ "${MYSQL_ACCESS_BROKER_USER}" = "${MYSQL_USER}" ]; then
|
|
echo "MYSQL_ACCESS_BROKER_USER must be an isolated non-root account" >&2
|
|
exit 1
|
|
fi
|
|
if [ "${MYSQL_ACCESS_BROKER_PASSWORD}" = "${MYSQL_PASSWORD}" ]; then
|
|
echo "MYSQL_ACCESS_BROKER_PASSWORD must differ from MYSQL_PASSWORD" >&2
|
|
exit 1
|
|
fi
|
|
if ! printf '%s' "${MYSQL_DATABASE}" | grep -Eq '^[A-Za-z][A-Za-z0-9_]{0,63}$'; then
|
|
echo "MYSQL_DATABASE must be a safe MySQL database name" >&2
|
|
exit 1
|
|
fi
|
|
if ! printf '%s' "${MYSQL_ACCESS_BROKER_PASSWORD}" | grep -Eq '^[A-Za-z0-9._~!@#%^+=:-]{24,128}$'; then
|
|
echo "MYSQL_ACCESS_BROKER_PASSWORD must be 24-128 URL-safe characters" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# The database code is the physical MySQL database name, so project databases
|
|
# do not share a technical prefix. Grant the non-administrative DDL/DML set
|
|
# globally, then use MySQL partial revokes to exclude the mutable mysql schema
|
|
# and sys views. information_schema and performance_schema are server-managed
|
|
# read-only schemas, and the SQL console also blocks every system schema. The
|
|
# dedicated platform_control database remains available to the service.
|
|
mysql --protocol=socket -uroot -p"${MYSQL_ROOT_PASSWORD}" -e \
|
|
"GRANT CREATE, DROP, ALTER, INDEX, REFERENCES, SELECT, INSERT, UPDATE, DELETE, CREATE VIEW, SHOW VIEW, TRIGGER ON *.* TO '${MYSQL_USER}'@'%';
|
|
GRANT SYSTEM_USER ON *.* TO '${MYSQL_USER}'@'%';
|
|
REVOKE CREATE, DROP, ALTER, INDEX, REFERENCES, SELECT, INSERT, UPDATE, DELETE, CREATE VIEW, SHOW VIEW, TRIGGER ON \`mysql\`.* FROM '${MYSQL_USER}'@'%';
|
|
REVOKE CREATE, DROP, ALTER, INDEX, REFERENCES, SELECT, INSERT, UPDATE, DELETE, CREATE VIEW, SHOW VIEW, TRIGGER ON \`sys\`.* FROM '${MYSQL_USER}'@'%';
|
|
CREATE USER IF NOT EXISTS '${MYSQL_ACCESS_BROKER_USER}'@'%' IDENTIFIED BY '${MYSQL_ACCESS_BROKER_PASSWORD}';
|
|
ALTER USER '${MYSQL_ACCESS_BROKER_USER}'@'%' IDENTIFIED BY '${MYSQL_ACCESS_BROKER_PASSWORD}' PASSWORD EXPIRE NEVER FAILED_LOGIN_ATTEMPTS 5 PASSWORD_LOCK_TIME 1;
|
|
GRANT SELECT, INSERT, UPDATE, DELETE, SHOW VIEW ON *.* TO '${MYSQL_ACCESS_BROKER_USER}'@'%' WITH GRANT OPTION;
|
|
GRANT CREATE USER ON *.* TO '${MYSQL_ACCESS_BROKER_USER}'@'%';
|
|
REVOKE SELECT, INSERT, UPDATE, DELETE, SHOW VIEW ON \`${MYSQL_DATABASE}\`.* FROM '${MYSQL_ACCESS_BROKER_USER}'@'%';
|
|
REVOKE SELECT, INSERT, UPDATE, DELETE, SHOW VIEW ON \`mysql\`.* FROM '${MYSQL_ACCESS_BROKER_USER}'@'%';
|
|
REVOKE SELECT, INSERT, UPDATE, DELETE, SHOW VIEW ON \`performance_schema\`.* FROM '${MYSQL_ACCESS_BROKER_USER}'@'%';
|
|
REVOKE SELECT, INSERT, UPDATE, DELETE, SHOW VIEW ON \`sys\`.* FROM '${MYSQL_ACCESS_BROKER_USER}'@'%';
|
|
FLUSH PRIVILEGES;"
|