feat: use envoy-hot-restarter.py and start-envoy.sh in all-in-one image

Author: thebengeu

common.vars.pkr.hcl

@@ -1 +1 @@
-postgres-version = "15.1.1.19"
+postgres-version = "15.1.1.20"

docker/all-in-one/Dockerfile

@@ -208,7 +208,10 @@ COPY docker/all-in-one/etc/logrotate.d/postgresql.conf /etc/logrotate.d/postgres
 COPY docker/all-in-one/etc/gotrue.env /etc/gotrue.env
 
 # Customizations for envoy
+ARG envoy_release
+ADD --chmod=755 --chown=envoy:envoy "https://raw.githubusercontent.com/envoyproxy/envoy/v${envoy_release}/restarter/hot-restarter.py" /opt/envoy-hot-restarter.py
 COPY --chmod=775 --chown=envoy:envoy ansible/files/envoy_config/ /etc/envoy/
+COPY --chmod=755 --chown=envoy:envoy ansible/files/start-envoy.sh /opt/
 
 # Customizations for kong
 COPY docker/all-in-one/etc/kong/kong.conf /etc/kong/kong.conf

docker/all-in-one/etc/supervisor/services/envoy.conf

@@ -1,7 +1,7 @@
 [program:envoy]
 # Workaround using `tee` to get `/dev/stdout` access logging to work, see:
 # https://github.com/envoyproxy/envoy/issues/8297#issuecomment-620659781
-command=bash -c 'set -o pipefail; /opt/envoy --config-path /etc/envoy/envoy.yaml 2>&1 | tee'
+command=/opt/envoy-hot-restarter.py /opt/start-envoy.sh
 user=envoy
 autorestart=true
 autostart=false

docker/all-in-one/init/configure-envoy.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 set -eou pipefail
 
-if [ "${ENVOY_ENABLED:-}" != "true" ]; then
+if [[ "${ENVOY_ENABLED:-}" != "true" ]]; then
   exit
 fi
 
@@ -11,40 +11,43 @@ touch /var/log/services/envoy.log
 
 /usr/local/bin/configure-shim.sh /dist/envoy /opt/envoy
 
-if [ "$DATA_VOLUME_MOUNTPOINT" ]; then
+if [[ -n "${DATA_VOLUME_MOUNTPOINT}" ]]; then
   ENVOY_CUSTOM_DIR="${DATA_VOLUME_MOUNTPOINT}/etc/envoy"
-  mkdir -p "$ENVOY_CUSTOM_DIR"
-  if [ ! -f "$CONFIGURED_FLAG_PATH" ]; then
+  mkdir -p "${ENVOY_CUSTOM_DIR}"
+  if [[ ! -f "${CONFIGURED_FLAG_PATH}" ]]; then
     echo "Copying existing custom envoy config from /etc/envoy/ to ${ENVOY_CUSTOM_DIR}"
     cp -R "/etc/envoy/." "${ENVOY_CUSTOM_DIR}/"
   fi
 
   rm -rf "/etc/envoy"
-  ln -s "$ENVOY_CUSTOM_DIR" "/etc/envoy"
-  chown -R adminapi:adminapi "/etc/envoy"
+  ln -s "${ENVOY_CUSTOM_DIR}" "/etc/envoy"
+  chown -R envoy:envoy "/etc/envoy"
+  chmod -R g+w "/etc/envoy"
 
-  chown -R adminapi:adminapi "$ENVOY_CUSTOM_DIR"
-  chmod g+rx "$ENVOY_CUSTOM_DIR"
+  chown -R envoy:envoy "${ENVOY_CUSTOM_DIR}"
+  chmod -R g+w "${ENVOY_CUSTOM_DIR}"
+  chmod g+rx "${ENVOY_CUSTOM_DIR}"
 fi
 
-if [ -f "${INIT_PAYLOAD_PATH:-}" ]; then
+if [[ -f "${INIT_PAYLOAD_PATH:-}" ]]; then
   echo "init envoy payload"
-  tar -xzvhf "$INIT_PAYLOAD_PATH" -C / ./etc/envoy/
-  chown -HR adminapi:adminapi /etc/envoy
+  tar -xzvhf "${INIT_PAYLOAD_PATH}" -C / ./etc/envoy/
+  chown -HR envoy:envoy /etc/envoy
+  chmod -HR g+w /etc/envoy
 fi
 
 # Inject project specific configuration
 # "c2VydmljZV9yb2xlOnNlcnZpY2Vfa2V5" is base64-encoded "service_role:service_key".
-sed -i -e "s|anon_key|$ANON_KEY|g" \
-  -e "s|service_key|$SERVICE_ROLE_KEY|g" \
-  -e "s|supabase_admin_key|$ADMIN_API_KEY|g" \
-  -e "s|c2VydmljZV9yb2xlOnNlcnZpY2Vfa2V5|$(echo -n "service_role:$SERVICE_ROLE_KEY" | base64 --wrap 0)|g" \
-  "$ENVOY_LDS_CONF"
+sed -i -e "s|anon_key|${ANON_KEY}|g" \
+  -e "s|service_key|${SERVICE_ROLE_KEY}|g" \
+  -e "s|supabase_admin_key|${ADMIN_API_KEY}|g" \
+  -e "s|c2VydmljZV9yb2xlOnNlcnZpY2Vfa2V5|$(echo -n "service_role:${SERVICE_ROLE_KEY}" | base64 --wrap 0)|g" \
+  "${ENVOY_LDS_CONF}"
 
 # Update Envoy ports
-sed -i "s|port_value: 80$|port_value: $ENVOY_HTTP_PORT|g" "$ENVOY_LDS_CONF"
-sed -i "s|port_value: 443$|port_value: $ENVOY_HTTPS_PORT|g" "$ENVOY_LDS_CONF"
-sed -i "s|port_value: 3000$|port_value: $PGRST_SERVER_PORT|g" "$ENVOY_CDS_CONF"
-sed -i "s|port_value: 3001$|port_value: $PGRST_ADMIN_SERVER_PORT|g" "$ENVOY_CDS_CONF"
-sed -i "s|port_value: 8085$|port_value: $ADMIN_API_PORT|g" "$ENVOY_CDS_CONF"
-sed -i "s|port_value: 9999$|port_value: $GOTRUE_API_PORT|g" "$ENVOY_CDS_CONF"
+sed -i "s|port_value: 80$|port_value: ${ENVOY_HTTP_PORT}|g" "${ENVOY_LDS_CONF}"
+sed -i "s|port_value: 443$|port_value: ${ENVOY_HTTPS_PORT}|g" "${ENVOY_LDS_CONF}"
+sed -i "s|port_value: 3000$|port_value: ${PGRST_SERVER_PORT}|g" "${ENVOY_CDS_CONF}"
+sed -i "s|port_value: 3001$|port_value: ${PGRST_ADMIN_SERVER_PORT}|g" "${ENVOY_CDS_CONF}"
+sed -i "s|port_value: 8085$|port_value: ${ADMIN_API_PORT}|g" "${ENVOY_CDS_CONF}"
+sed -i "s|port_value: 9999$|port_value: ${GOTRUE_API_PORT}|g" "${ENVOY_CDS_CONF}"