From 34981c30a78e8bbd7791131059a9210f9928b62c Mon Sep 17 00:00:00 2001
From: 刘光辉 <347230014@qq.com>
Date: 星期四, 17 九月 2026 09:24:09 +0800
Subject: [PATCH] Merge remote-tracking branch 'origin/master' into master
---
docker/postgres/tencent/harden-pg-hba.sh | 39 +++++++++++++++++++++++++++++++++++++++
1 files changed, 39 insertions(+), 0 deletions(-)
diff --git a/docker/postgres/tencent/harden-pg-hba.sh b/docker/postgres/tencent/harden-pg-hba.sh
new file mode 100644
index 0000000..08f1778
--- /dev/null
+++ b/docker/postgres/tencent/harden-pg-hba.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# 鏀剁揣 cx-postgres 鐨� pg_hba.conf锛歱ostgres 瓒呮埛銆愬彧鍏佽 docker 鍐呯綉銆戙�佸叕缃戜竴寰� reject锛岀劧鍚� reload銆�
+#
+# 绛栫暐锛堝湪绗竴鏉� "host all all all" 瑙勫垯銆愪箣鍓嶃�戞彃鍏� 3 琛岋紝pg_hba 棣栦釜鍖归厤鍗崇敓鏁堬級锛�
+# 1) host all postgres 172.16.0.0/12 scram-sha-256 鈥斺�� docker 鍐呯綉(pgloader 杩佺Щ鐢�)鏀捐锛岄渶瀵嗙爜
+# 2) host all postgres 0.0.0.0/0 reject 鈥斺�� 鍏朵綑(鍏綉)涓�寰嬫嫆缁濊秴鎴�
+# 3) host all postgres ::/0 reject
+# 涓氬姟瑙掕壊(jnpf_app 绛�)涓嶅尮閰嶄笂杩� user=postgres 瑙勫垯锛岀户缁蛋鏈熬 host-all-all-all scram锛岀収甯歌繙绋嬪彲杩炪��
+# 涓轰綍鏀捐 172.16/12锛歅art C 鐨� S1 閲嶈縼 pgloader 浠� docker 鍐呯綉(172.x)鐢� postgres 鐏屾暟鎹紝闇�淇濈暀锛�
+# 鍏綉(闈炵鏈夌綉娈�)鍛戒腑 reject锛岀旱娣遍槻寰�(鍗充究瓒呮埛瀵嗙爜娉勯湶涔熸棤娉曚粠鍏綉鐧诲綍)銆�
+# 鏈湴 127.0.0.1/socket 鐨� trust 瑙勫垯鏇撮潬鍓嶏紝涓嶅彈褰卞搷(docker exec 鐓у父)銆�
+#
+# 骞傜瓑锛氬凡鎻掑叆鍒欒烦杩囥�傚鍣ㄥ唴 psql 璧� socket=trust锛屾棤闇�瀵嗙爜銆�
+set -euo pipefail
+CONTAINER="${CONTAINER:-cx-postgres}"
+
+docker exec -i "$CONTAINER" bash -s <<'INNER'
+set -euo pipefail
+PGDATA="$(ls -d /var/lib/postgresql/*/docker 2>/dev/null | head -1)"
+HBA="$PGDATA/pg_hba.conf"
+[ -f "$HBA" ] || { echo "!! 鎵句笉鍒� pg_hba.conf ($HBA)"; exit 1; }
+if grep -qE 'postgres[[:space:]]+172\.16\.0\.0/12' "$HBA"; then
+ echo "pg_hba 宸插惈 postgres 鍐呯綉鏀捐+鍏綉 reject锛岃烦杩�"
+else
+ awk '
+ !done && $1=="host" && $2=="all" && $3=="all" && $4=="all" {
+ print "host all postgres 172.16.0.0/12 scram-sha-256"
+ print "host all postgres 0.0.0.0/0 reject"
+ print "host all postgres ::/0 reject"
+ done=1
+ }
+ { print }
+ ' "$HBA" > "$HBA.new"
+ mv "$HBA.new" "$HBA"
+ echo "宸插湪 host-all-all-all 鍓嶆彃鍏� postgres 鍐呯綉鏀捐+鍏綉 reject"
+fi
+INNER
+
+docker exec "$CONTAINER" psql -U postgres -c "SELECT pg_reload_conf();"
--
Gitblit v1.8.0