Keep role re-assertion within a non-superuser provisioner's rights, and test the second boot

2026-08-19 00:44:49 +02:00
parent 6db14a2205
commit c5c9cce2b6
12 changed files with 173 additions and 63 deletions
@@ -153,6 +153,7 @@ services:
      # `storage` fails the seed loudly. The secret must match web's; both derive the same passwords.
      PLUGIN_DB_ADMIN_URL: ${PLUGIN_DB_ADMIN_URL:-}
      PLUGIN_DB_SECRET: ${PLUGIN_DB_SECRET:-}
+      PLUGIN_DB_URL: ${PLUGIN_DB_URL:-} # only to refuse a mismatch: what bootstrap creates, web connects to
      REQUIRE_SECURE_SECRETS: "true" # refuse the throwaway secret here too, before any role is created
    volumes:
      - ./ory/kratos/tokenizer:/etc/config/kratos/tokenizer