Skip to content

Commit 8f2620f

Browse files
labkey-teamcitylabkey-teamcity
committed
Merge 26.6 to develop
2 parents 3d16e43 + c3b4dbb commit 8f2620f

7 files changed

Lines changed: 232 additions & 37 deletions

File tree

‎CLAUDE.md‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# CLAUDE.md
2+
3+
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
4+
5+
## What This Repo Does
6+
7+
Builds and publishes Docker images for LabKey Server (a biomedical data management platform) to AWS ECR. A single `Dockerfile` produces multiple distributions (`community`, `enterprise`, `lims_starter`, `allpg`) via the `LABKEY_DISTRIBUTION` build arg.
8+
9+
## Common Commands
10+
11+
```bash
12+
# Local development cycle
13+
make build # Build image locally (uses local .jar if present)
14+
make up # Run community via docker-compose (https://localhost:8443)
15+
make up-enterprise # Run enterprise distribution
16+
make up-lims_starter
17+
make down # Tear down containers
18+
make test # Run smoke.bash health check against running container
19+
20+
# Lint
21+
# Hadolint runs in CI; run locally via:
22+
docker run --rm -i hadolint/hadolint < Dockerfile
23+
24+
# AWS ECR workflow
25+
make login # Authenticate to ECR
26+
make tag # Tag image for ECR
27+
make push # Push to ECR
28+
make all # login → build → tag → push (default)
29+
```
30+
31+
## Architecture
32+
33+
### Build Flow
34+
35+
`Dockerfile` downloads the LabKey `.tar.gz` from a URL (or uses a local `.jar` file placed in the repo root for development). The `LABKEY_VERSION` and `LABKEY_DISTRIBUTION` build args control which artifact is fetched. Base image is `eclipse-temurin:25-jre-noble` (Debian); Alpine variant is also supported.
36+
37+
### Runtime
38+
39+
`entrypoint.sh` is the container entry point. It:
40+
1. Validates required `LABKEY_*` env vars (excludes `*SSM*`, `*GUID*`, `*MEK*`, initial-user vars)
41+
2. Optionally downloads startup properties from S3
42+
3. Handles SSM vs. non-AWS mode: if `LABKEY_SSM_PREFIX` is set, normalizes trailing slashes on both prefix vars; otherwise removes the `context.awsParameterStore.prefix` line and substitutes `ssm:` references in `application.properties` with direct env var values
43+
4. Runs `envsubst` on all `.properties` files, then `sed` to substitute `@@placeholder@@` values
44+
5. Generates a self-signed TLS keystore via `openssl`
45+
6. Unsets connection/SMTP env vars, then `exec`s `java -jar labkeyServer.jar`
46+
47+
### Multi-Distribution
48+
49+
The `startup/` directory contains per-distribution `.properties` files (`community.properties`, `enterprise.properties`, etc.). The `LABKEY_DISTRIBUTION` env var selects which file is copied in at build time and passed to the JVM.
50+
51+
### Configuration Surface
52+
53+
Almost all runtime behavior is controlled via environment variables. The major groups are documented in `README.md`:
54+
- **DB**: `POSTGRES_*` — connection, pooling
55+
- **App**: `LABKEY_*` — version, distribution, base URL, encryption key, initial user
56+
- **SSM (AWS, 26.6+)**: `LABKEY_SSM_PREFIX` (app-level prefix) and `LABKEY_VPC_SSM_PREFIX` (VPC-level prefix) — when set, DB credentials (`database_user`, `database_password`), encryption key (`ek`), and SMTP credentials (`smtp_user`, `smtp_password`) are fetched from SSM instead of env vars; see `application.properties` for the `ssm:` references and `README.md` for the full SSM parameter table
57+
- **JVM**: `JAVA_*`, `MAX_JVM_RAM_PERCENT`, `JAVA_PRE_JAR_EXTRA` / `JAVA_POST_JAR_EXTRA`
58+
- **SSL**: `CERT_*`, `TOMCAT_KEYSTORE_*`
59+
- **Observability**: Datadog APM (`dd-java-agent.jar` baked in), `LOG_LEVEL_*`, `LOGGER_PATTERN`
60+
- **Debug**: `DEBUG=1` installs extra tools (ping, netcat, vim, etc.) at runtime
61+
62+
### CI/CD (GitHub Actions)
63+
64+
| Workflow | Trigger |
65+
|----------|---------|
66+
| `hadolint.yml` | Push to `fb_*` / `*_fb_*`; PRs to develop/release* |
67+
| `validate_pr.yml` | PR opened/ready for review |
68+
| `merge_release.yml` | PR review approved (auto-merges release branches) |
69+
| `dockle_xeol.yml` | Security scanning |
70+
| `branch_release.yml` | Release branch automation |
71+
72+
Feature branches follow the pattern `fb_<description>` or `<version>_fb_<description>`.
73+
74+
### Local JAR Development
75+
76+
Place a `labkeyServer.jar.*` file in the repo root (already gitignored). The `Makefile` detects it and uses it as the build artifact instead of downloading from a remote URL, enabling local iteration without publishing.

‎Makefile‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,21 @@ LABKEY_VERSION ?= 21.5-SNAPSHOT
3030
LABKEY_DISTRIBUTION ?= community
3131
LABKEY_EK ?= 123abc456
3232

33+
# When running with SSM credentials, seed postgres with the same DB user/password
34+
# that LabKey will fetch from SSM — otherwise the pg container initializes with
35+
# its defaults (postgres/localdevpassword) and auth fails.
36+
ifdef LABKEY_SSM_PREFIX
37+
_SSM_NORMED := $(shell echo '$(LABKEY_SSM_PREFIX)' | sed 's:/*$$:/:')
38+
_SSM_DB_USER := $(shell aws ssm get-parameter --name '$(_SSM_NORMED)database_user' --with-decryption --query 'Parameter.Value' --output text 2>/dev/null)
39+
_SSM_DB_PASS := $(shell aws ssm get-parameter --name '$(_SSM_NORMED)database_password' --with-decryption --query 'Parameter.Value' --output text 2>/dev/null)
40+
ifneq ($(_SSM_DB_USER),)
41+
POSTGRES_USER ?= $(_SSM_DB_USER)
42+
endif
43+
ifneq ($(_SSM_DB_PASS),)
44+
POSTGRES_PASSWORD ?= $(_SSM_DB_PASS)
45+
endif
46+
endif
47+
3348
LOG4J_CONFIG_OVERRIDE ?= default.log4j2.xml
3449

3550
BUILD_ARCHITECTURE ?= linux/amd64

‎README.md‎

Lines changed: 32 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -187,7 +187,7 @@ A better description of the LabKey settings can be found in the LabKey docs [her
187187
| LABKEY_DISTRIBUTION | "flavor" of labkey; | `community` |
188188
| LABKEY_FILES_ROOT | path within which will serve as the root of the "files" directory | `/labkey/files` |
189189
| LABKEY_GUID | LabKey [server GUID](https://www.labkey.org/Documentation/wiki-page.view?name=stagingServerTips#guid) | `<empty>` |
190-
| LABKEY_EK | LabKey [encryption key](https://www.labkey.org/Documentation/wiki-page.view?name=cpasxml#encrypt) | `123abc456` |
190+
| LABKEY_EK | LabKey [encryption key](https://www.labkey.org/Documentation/wiki-page.view?name=cpasxml#encrypt); not needed when using AWS SSM integration (see below) | `123abc456` |
191191
| LABKEY_PORT | port to which labkey will bind within the container | `8443` |
192192
| LABKEY_SYSTEM_DESCRIPTION | brief description of server; appears in emails | `Sirius Cybernetics` |
193193
| LABKEY_SYSTEM_EMAIL_ADDRESS | email address system email will be sent "from" | `do_not_reply@localhost` |
@@ -216,6 +216,8 @@ Initial user API key creation was implemented in LabKey Server 20.11.
216216
217217
The `POSTGRES_*` default values are meant to match those of the [library/postgres](https://hub.docker.com/_/postgres) containers.
218218
219+
`POSTGRES_USER` and `POSTGRES_PASSWORD` are not needed when using AWS SSM integration (see below).
220+
219221
| name | purpose | default |
220222
| ------------------- | ------------------------------------------------------------------------- | ----------- |
221223
| POSTGRES_DB | "name" of database; compounds to URI connection string | `postgres` |
@@ -229,6 +231,8 @@ The `POSTGRES_*` default values are meant to match those of the [library/postgre
229231
230232
These replace values previously housed in `context.xml` (`ROOT.xml` or `labkey.xml`) governing `mail/Session` resources.
231233
234+
`SMTP_USER` and `SMTP_PASSWORD` are not needed when using AWS SSM integration (see below).
235+
232236
| name | purpose | default |
233237
| ------------- | --------------------------- | ----------- |
234238
| SMTP_HOST | SMTP host configuration | `localhost` |
@@ -239,6 +243,33 @@ These replace values previously housed in `context.xml` (`ROOT.xml` or `labkey.x
239243
| SMTP_AUTH | SMTP Auth flag | `false` |
240244
| SMTP_STARTTLS | SMTP STARTTLS flag | `<empty>` |
241245
246+
## AWS SSM Integration (LabKey 26.6+)
247+
248+
For AWS deployments on LabKey 26.6+, DB credentials, the encryption key, and SMTP credentials can be resolved directly from AWS SSM Parameter Store by the JVM at startup, rather than being injected as container env vars. This uses LabKey's `AwsParameterStoreEnvironmentPostProcessor`.
249+
250+
Set two path-prefix env vars and create the corresponding SSM parameters:
251+
252+
| name | purpose | example |
253+
| ---------------------- | ----------------------------------------------------- | -------------------------- |
254+
| `LABKEY_SSM_PREFIX` | App-specific SSM prefix (DB creds, encryption key) | `/myapp/myenv/` |
255+
| `LABKEY_VPC_SSM_PREFIX`| VPC-level shared SSM prefix (SMTP credentials) | `/shared/vpc/myvpc/` |
256+
257+
Trailing slashes on both prefixes are normalized automatically by `entrypoint.sh`.
258+
259+
**Expected SSM parameters:**
260+
261+
| SSM path | replaces env var |
262+
| ----------------------------------------- | ------------------- |
263+
| `${LABKEY_SSM_PREFIX}database_user` | `POSTGRES_USER` |
264+
| `${LABKEY_SSM_PREFIX}database_password` | `POSTGRES_PASSWORD` |
265+
| `${LABKEY_SSM_PREFIX}ek` | `LABKEY_EK` |
266+
| `${LABKEY_VPC_SSM_PREFIX}smtp_user` | `SMTP_USER` |
267+
| `${LABKEY_VPC_SSM_PREFIX}smtp_password` | `SMTP_PASSWORD` |
268+
269+
When `LABKEY_SSM_PREFIX` is set, `POSTGRES_USER`, `POSTGRES_PASSWORD`, `LABKEY_EK`, `SMTP_USER`, and `SMTP_PASSWORD` env vars are not used. When `LABKEY_SSM_PREFIX` is unset (local / non-AWS), the container falls back to those env vars as before.
270+
271+
In ECS, the container task role provides credentials via IMDS — no AWS credential env vars needed. For local testing with SSM, export `AWS_REGION`, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_SESSION_TOKEN` (or use aws-vault) so the JVM can reach SSM.
272+
242273
## SSL/Keystore/Self-signed Cert
243274

244275
The `CERT_*` ENVs should look familiar to anyone that has used the `openssl` command to generate a pkcs12 keystore.

‎application.properties‎

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,15 @@ context.resources.jdbc.labkeyDataSource.driverClassName=org.postgresql.Driver
1818
# context.resources.jdbc.labkeyDataSource.username=${POSTGRES_USER:-postgres}
1919
# context.resources.jdbc.labkeyDataSource.password=${POSTGRES_PASSWORD:-}
2020

21-
context.resources.jdbc.labkeyDataSource.url=@@jdbcUrl@@
22-
context.resources.jdbc.labkeyDataSource.username=@@jdbcUser@@
23-
context.resources.jdbc.labkeyDataSource.password=@@jdbcPassword@@
21+
# AWS SSM prefix for resolving ssm: references below. Set LABKEY_SSM_PREFIX to /${app_param_path} (e.g. /myapp/myenv/).
22+
# Leave unset for non-AWS deployments as the post-processor is a no-op when no ssm: values are present.
23+
context.awsParameterStore.prefix=${LABKEY_SSM_PREFIX}
2424

25+
context.resources.jdbc.labkeyDataSource.url=@@jdbcUrl@@
26+
# context.resources.jdbc.labkeyDataSource.username=@@jdbcUser@@
27+
# context.resources.jdbc.labkeyDataSource.password=@@jdbcPassword@@
28+
context.resources.jdbc.labkeyDataSource.username=ssm:database_user
29+
context.resources.jdbc.labkeyDataSource.password=ssm:database_password
2530
context.resources.jdbc.labkeyDataSource.maxTotal=${POSTGRES_MAX_TOTAL_CONNECTIONS}
2631
context.resources.jdbc.labkeyDataSource.maxIdle=${POSTGRES_MAX_IDLE_CONNECTIONS}
2732
context.resources.jdbc.labkeyDataSource.maxWaitMillis=${POSTGRES_MAX_WAIT_MILLIS}
@@ -57,7 +62,8 @@ server.ssl.key-store=${LABKEY_HOME}/${TOMCAT_KEYSTORE_FILENAME}
5762
# server.ssl.key-store-password=${TOMCAT_KEYSTORE_PASSWORD}
5863
server.ssl.key-store-type=${TOMCAT_KEYSTORE_FORMAT}
5964

60-
context.encryptionKey=@@encryptionKey@@
65+
# context.encryptionKey=@@encryptionKey@@
66+
context.encryptionKey=ssm:ek
6167

6268

6369
#
@@ -69,9 +75,12 @@ server.servlet.context-path=/_
6975
server.error.whitelabel.enabled=false
7076

7177
mail.smtpHost=@@smtpHost@@
72-
mail.smtpUser=@@smtpUser@@
78+
# mail.smtpUser=@@smtpUser@@
79+
# LABKEY_VPC_SSM_PREFIX is the VPC-level shared SSM path prefix (e.g. /shared/vpc/myvpc/), expanded by envsubst at startup.
80+
mail.smtpUser=ssm:${LABKEY_VPC_SSM_PREFIX}smtp_user
7381
mail.smtpPort=@@smtpPort@@
74-
mail.smtpPassword=@@smtpPassword@@
82+
# mail.smtpPassword=@@smtpPassword@@
83+
mail.smtpPassword=ssm:${LABKEY_VPC_SSM_PREFIX}smtp_password
7584
mail.smtpAuth=@@smtpAuth@@
7685
mail.smtpFrom=@@smtpFrom@@
7786
mail.smtpStartTlsEnable=@@smtpStartTlsEnable@@

‎docker-compose.yml‎

Lines changed: 61 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,6 @@ services:
3636

3737
- LOGGER_PATTERN=%-80.80logger{79}
3838

39-
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-a"placeholder#'password}
4039
- POSTGRES_HOST=pg-community
4140

4241
- MAX_JVM_RAM_PERCENT=${MAX_JVM_RAM_PERCENT:-75.0}
@@ -48,13 +47,24 @@ services:
4847
- SMTP_HOST=${SMTP_HOST}
4948
- SMTP_AUTH=true
5049
- SMTP_PORT=587
51-
- SMTP_USER=${SMTP_USER}
52-
- SMTP_PASSWORD=${SMTP_PASSWORD}
5350
- SMTP_STARTTLS=true
5451

5552
- LABKEY_SYSTEM_EMAIL_ADDRESS=${SMTP_FROM}
5653
# - SMTP_FROM=
5754

55+
- LABKEY_SSM_PREFIX=${LABKEY_SSM_PREFIX}
56+
- LABKEY_VPC_SSM_PREFIX=${LABKEY_VPC_SSM_PREFIX}
57+
- AWS_REGION=${AWS_REGION}
58+
- AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
59+
- AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
60+
- AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN}
61+
# non-AWS: set these to supply credentials directly instead of via SSM
62+
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-localdevpassword}
63+
- POSTGRES_USER=${POSTGRES_USER:-postgres}
64+
- LABKEY_EK=${LABKEY_EK:-}
65+
- SMTP_USER=${SMTP_USER:-}
66+
- SMTP_PASSWORD=${SMTP_PASSWORD:-}
67+
5868
# uncomment to enable CAS against labkey.org
5969
# - |
6070
# LABKEY_STARTUP_BASIC_EXTRA='
@@ -83,7 +93,7 @@ services:
8393
- LOG4J_CONFIG_FILE=${LOG4J_CONFIG_FILE-log4j2.xml}
8494
- LOG4J_CONFIG_OVERRIDE=${LOG4J_CONFIG_OVERRIDE}
8595
- JSON_OUTPUT=${JSON_OUTPUT-false}
86-
- DD_COLLECT_APM=${DD_COLLECT_APM-false}
96+
- DD_COLLECT_APM=${DD_COLLECT_APM-false}
8797
- SLEEP=${SLEEP:-0}
8898

8999
pg-community:
@@ -99,7 +109,8 @@ services:
99109
- "-c"
100110
- "docker-entrypoint.sh postgres >/dev/null 2>&1"
101111
environment:
102-
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-a"placeholder#'password}
112+
- POSTGRES_USER=${POSTGRES_USER:-postgres}
113+
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-localdevpassword}
103114
healthcheck:
104115
test: ["CMD", "pg_isready", "-U", "postgres"]
105116
interval: 30s
@@ -148,7 +159,6 @@ services:
148159

149160
- LOGGER_PATTERN=%-80.80logger{79}
150161

151-
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-a"placeholder#'password}
152162
- POSTGRES_HOST=pg-allpg
153163

154164
- MAX_JVM_RAM_PERCENT=${MAX_JVM_RAM_PERCENT:-75.0}
@@ -160,13 +170,24 @@ services:
160170
- SMTP_HOST=${SMTP_HOST}
161171
- SMTP_AUTH=true
162172
- SMTP_PORT=587
163-
- SMTP_USER=${SMTP_USER}
164-
- SMTP_PASSWORD=${SMTP_PASSWORD}
165173
- SMTP_STARTTLS=true
166174

167175
- LABKEY_SYSTEM_EMAIL_ADDRESS=${SMTP_FROM}
168176
# - SMTP_FROM=
169177

178+
- LABKEY_SSM_PREFIX=${LABKEY_SSM_PREFIX}
179+
- LABKEY_VPC_SSM_PREFIX=${LABKEY_VPC_SSM_PREFIX}
180+
- AWS_REGION=${AWS_REGION}
181+
- AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
182+
- AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
183+
- AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN}
184+
# non-AWS: set these to supply credentials directly instead of via SSM
185+
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-localdevpassword}
186+
- POSTGRES_USER=${POSTGRES_USER:-postgres}
187+
- LABKEY_EK=${LABKEY_EK:-}
188+
- SMTP_USER=${SMTP_USER:-}
189+
- SMTP_PASSWORD=${SMTP_PASSWORD:-}
190+
170191
# uncomment to enable CAS against labkey.org
171192
# - |
172193
# LABKEY_STARTUP_BASIC_EXTRA='
@@ -211,7 +232,8 @@ services:
211232
- "-c"
212233
- "docker-entrypoint.sh postgres >/dev/null 2>&1"
213234
environment:
214-
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-a"placeholder#'password}
235+
- POSTGRES_USER=${POSTGRES_USER:-postgres}
236+
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-localdevpassword}
215237
healthcheck:
216238
test: ["CMD", "pg_isready", "-U", "postgres"]
217239
interval: 30s
@@ -258,7 +280,6 @@ services:
258280

259281
- LOGGER_PATTERN=%-80.80logger{79}
260282

261-
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-a"placeholder#'password}
262283
- POSTGRES_HOST=pg-enterprise
263284

264285
- MAX_JVM_RAM_PERCENT=${MAX_JVM_RAM_PERCENT:-75.0}
@@ -270,13 +291,24 @@ services:
270291
- SMTP_HOST=${SMTP_HOST}
271292
- SMTP_AUTH=true
272293
- SMTP_PORT=587
273-
- SMTP_USER=${SMTP_USER}
274-
- SMTP_PASSWORD=${SMTP_PASSWORD}
275294
- SMTP_STARTTLS=true
276295

277296
- LABKEY_SYSTEM_EMAIL_ADDRESS=${SMTP_FROM}
278297
# - SMTP_FROM=
279298

299+
- LABKEY_SSM_PREFIX=${LABKEY_SSM_PREFIX}
300+
- LABKEY_VPC_SSM_PREFIX=${LABKEY_VPC_SSM_PREFIX}
301+
- AWS_REGION=${AWS_REGION}
302+
- AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
303+
- AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
304+
- AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN}
305+
# non-AWS: set these to supply credentials directly instead of via SSM
306+
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-localdevpassword}
307+
- POSTGRES_USER=${POSTGRES_USER:-postgres}
308+
- LABKEY_EK=${LABKEY_EK:-}
309+
- SMTP_USER=${SMTP_USER:-}
310+
- SMTP_PASSWORD=${SMTP_PASSWORD:-}
311+
280312
# uncomment to enable CAS against labkey.org
281313
# - |
282314
# LABKEY_STARTUP_BASIC_EXTRA='
@@ -321,7 +353,8 @@ services:
321353
- "-c"
322354
- "docker-entrypoint.sh postgres >/dev/null 2>&1"
323355
environment:
324-
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-a"placeholder#'password}
356+
- POSTGRES_USER=${POSTGRES_USER:-postgres}
357+
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-localdevpassword}
325358
healthcheck:
326359
test: ["CMD", "pg_isready", "-U", "postgres"]
327360
interval: 30s
@@ -369,7 +402,6 @@ services:
369402

370403
- LOGGER_PATTERN=%-80.80logger{79}
371404

372-
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-a"placeholder#'password}
373405
- POSTGRES_HOST=pg-lims_starter
374406

375407
- MAX_JVM_RAM_PERCENT=${MAX_JVM_RAM_PERCENT:-75.0}
@@ -381,13 +413,24 @@ services:
381413
- SMTP_HOST=${SMTP_HOST}
382414
- SMTP_AUTH=true
383415
- SMTP_PORT=587
384-
- SMTP_USER=${SMTP_USER}
385-
- SMTP_PASSWORD=${SMTP_PASSWORD}
386416
- SMTP_STARTTLS=true
387417

388418
- LABKEY_SYSTEM_EMAIL_ADDRESS=${SMTP_FROM}
389419
# - SMTP_FROM=
390420

421+
- LABKEY_SSM_PREFIX=${LABKEY_SSM_PREFIX}
422+
- LABKEY_VPC_SSM_PREFIX=${LABKEY_VPC_SSM_PREFIX}
423+
- AWS_REGION=${AWS_REGION}
424+
- AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
425+
- AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
426+
- AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN}
427+
# non-AWS: set these to supply credentials directly instead of via SSM
428+
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-localdevpassword}
429+
- POSTGRES_USER=${POSTGRES_USER:-postgres}
430+
- LABKEY_EK=${LABKEY_EK:-}
431+
- SMTP_USER=${SMTP_USER:-}
432+
- SMTP_PASSWORD=${SMTP_PASSWORD:-}
433+
391434
# uncomment to enable CAS against labkey.org
392435
# - |
393436
# LABKEY_STARTUP_BASIC_EXTRA='
@@ -435,7 +478,8 @@ services:
435478
- "-c"
436479
- "docker-entrypoint.sh postgres >/dev/null 2>&1"
437480
environment:
438-
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-a"placeholder#'password}
481+
- POSTGRES_USER=${POSTGRES_USER:-postgres}
482+
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-localdevpassword}
439483
healthcheck:
440484
test: ["CMD", "pg_isready", "-U", "postgres"]
441485
interval: 30s

0 commit comments

Comments
 (0)