Cleanup

example/init/vault-database

@@ -2,7 +2,7 @@
 
 set -euo pipefail
 
-vault write database/roles/miniflux \
+vault write /database/roles/miniflux \
     db_name="postgres" \
     creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
         GRANT \"miniflux\" TO \"{{name}}\"; \

example/miniflux.nomad.hcl

@@ -69,10 +69,10 @@ job "miniflux" {
       tags = [
 
         "traefik.enable=true",
-        "traefik.http.routers.miniflux.rule=Host(`flux.example.org`)",
         "traefik.http.routers.miniflux.entrypoints=https",
-        "traefik.http.middlewares.miniflux-csp.headers.contentsecuritypolicy=default-src 'self';font-src 'self' data:;img-src 'self' data:;script-src 'self' 'unsafe-inline' 'unsafe-eval';style-src 'self' 'unsafe-inline';",
-        "traefik.http.routers.miniflux.middlewares=security-headers@file,rate-limit-std@file,forward-proto@file,inflight-std@file,hsts@file,compression@file,miniflux-csp",
+        "traefik.http.routers.miniflux.rule=Host(`flux.example.org`)",
+        "traefik.http.middlewares.csp-miniflux.headers.contentsecuritypolicy=default-src 'self';font-src 'self' data:;img-src 'self' data:;script-src 'self' 'unsafe-inline' 'unsafe-eval';style-src 'self' 'unsafe-inline';",
+        "traefik.http.routers.miniflux.middlewares=security-headers@file,rate-limit-std@file,forward-proto@file,inflight-std@file,hsts@file,compression@file,csp-miniflux",
 
       ]
     }
@@ -137,7 +137,7 @@ job "miniflux" {
 
       template {
         data        = <<_EOT
-DATABASE_URL=postgresql://{{ with secret "database/creds/miniflux" }}{{ .Data.username }}{{ end }}:{{ with secret "database/creds/miniflux" }}{{ urlquery .Data.password }}{{ end }}@127.0.0.1:5432/miniflux?sslmode=disable
+DATABASE_URL=postgresql://{{ with secret "/database/creds/miniflux" }}{{ .Data.username }}{{ end }}:{{ with secret "/database/creds/miniflux" }}{{ urlquery .Data.password }}{{ end }}@127.0.0.1:5432/miniflux?sslmode=disable
 _EOT
         destination = "secrets/.db.env"
         perms       = 400

example/vault/policies/miniflux.hcl

@@ -1,6 +1,6 @@
-path "kv/data/service/miniflux" {
+path "/kv/data/service/miniflux" {
   capabilities = ["read"]
 }
-path "database/creds/miniflux" {
+path "/database/creds/miniflux" {
   capabilities = ["read"]
 }

init/vault-database

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -euo pipefail
+
+[[ template "common/vault.mkpgrole.sh" merge .miniflux . ]]

init/vault-miniflux

@@ -1,8 +0,0 @@
-#!/bin/sh
-
-set -euo pipefail
-
-[[- template "common/vault.mkpgrole.sh"
-  dict "ctx" .
-       "config" (dict "role" .instance "database" "postgres")
-]]

miniflux.nomad.hcl

@@ -1,7 +1,7 @@
-[[- $c := merge .miniflux . -]]
-
 job "[[ .instance ]]" {
 
+[[- $c := merge .miniflux . ]]
+
 [[ template "common/job_start" $c ]]
 
   group "miniflux" {
@@ -78,8 +78,8 @@ DATABASE_URL=postgresql://
 [[- end ]]
 _EOT
         destination = "secrets/.db.env"
-        perms = 400
-        env = true
+        perms       = 400
+        env         = true
       }
 
 [[ template "common/file_env" $c ]]

variables.yml

@@ -24,11 +24,6 @@ miniflux:
         - destination_name: 'postgres[[ .consul.suffix ]]'
           local_bind_port: 5432
 
-  postgres:
-    database: '[[ .instance ]]'
-    user: '{{ with secret "[[ .vault.prefix ]]database/creds/[[ .instance ]]" }}{{ .Data.username }}{{ end }}'
-    password: '{{ with secret "[[ .vault.prefix ]]database/creds/[[ .instance ]]" }}{{ .Data.password }}{{ end }}'
-
   vault:
     policies:
       - '[[ .instance ]][[ .consul.suffix ]]'

vault/policies/miniflux.hcl

@@ -1,6 +1,6 @@
-path "[[ .vault.prefix ]]kv/data/service/[[ .instance ]]" {
+path "[[ .vault.root ]]kv/data/service/[[ .instance ]]" {
   capabilities = ["read"]
 }
-path "[[ .vault.prefix ]]database/creds/[[ .instance ]]" {
+path "[[ .vault.root ]]database/creds/[[ .instance ]]" {
   capabilities = ["read"]
 }