@@ -693,6 +693,7 @@ in
693693 RemainAfterExit = true;
694694 User = "postgres";
695695 Group = "postgres";
696+ LoadCredential = [ "db_password:${cfg.database.passwordFile}" ];
696697 };
697698 script = ''
698699 set -o errexit -o pipefail -o nounset -o errtrace
@@ -701,7 +702,8 @@ in
701702 create_role="$(mktemp)"
702703 trap 'rm -f "$create_role"' ERR EXIT
703704
704− echo "CREATE ROLE keycloak WITH LOGIN PASSWORD '$(<'${cfg.database.passwordFile}')' CREATEDB" > "$create_role"
705+ db_password="$(<"$CREDENTIALS_DIRECTORY/db_password")"
706+ echo "CREATE ROLE keycloak WITH LOGIN PASSWORD '$db_password' CREATEDB" > "$create_role"
705707 psql -tAc "SELECT 1 FROM pg_roles WHERE rolname='keycloak'" | grep -q 1 || psql -tA --file="$create_role"
706708 psql -tAc "SELECT 1 FROM pg_database WHERE datname = 'keycloak'" | grep -q 1 || psql -tAc 'CREATE DATABASE "keycloak" OWNER "keycloak"'
707709 '';
@@ -717,14 +719,14 @@ in
717719 RemainAfterExit = true;
718720 User = config.services.mysql.user;
719721 Group = config.services.mysql.group;
722+ LoadCredential = [ "db_password:${cfg.database.passwordFile}" ];
720723 };
721724 script = ''
722725 set -o errexit -o pipefail -o nounset -o errtrace
723726 shopt -s inherit_errexit
724−
725− db_password="$(<'${cfg.database.passwordFile}')"
727+ db_password="$(<"$CREDENTIALS_DIRECTORY/db_password")"
726728 ( echo "CREATE USER IF NOT EXISTS 'keycloak'@'localhost' IDENTIFIED BY '$db_password';"
727− echo "CREATE DATABASE keycloak CHARACTER SET utf8 COLLATE utf8_unicode_ci;"
729+ echo "CREATE DATABASE IF NOT EXISTS keycloak CHARACTER SET utf8 COLLATE utf8_unicode_ci;"
728730 echo "GRANT ALL PRIVILEGES ON keycloak.* TO 'keycloak'@'localhost';"
729731 ) | mysql -N
730732 '';