# keeper/guacamole-db-postgres

**Image:** `keeper/guacamole-db-postgres`

`keeper/guacamole-db-postgres` is a Dockerized deployment of PostgreSQL, built off [Docker's official PostgreSQL image](https://hub.docker.com/_/postgres) which is automatically initialized with the Apache Guacamole database schema. It is built using the packages provided by Keeper Connection Manager and made available under the same [EULA](https://www.keepersecurity.com/en_GB/termsofuse.html?t=v). It is normally used to provide a PostgreSQL database for a container using the [`keeper/guacamole`](https://docs.keeper.io/en/keeper-connection-manager/installation/docker-compose-install/keeper-guacamole) image.

### Environment variables <a href="#id-.glyptodon-guacamoledbpostgresv1.x-environmentvariables" id="id-.glyptodon-guacamoledbpostgresv1.x-environmentvariables"></a>

In addition to the environment variables documented below, all environment variables supported by [the official Docker PostgreSQL image](http://confluence.glyptodon.com/_/postgres) are accepted, as the official PostgreSQL image forms the basis of this image.

#### `ACCEPT_EULA` <a href="#id-.glyptodon-guacamoledbpostgresv1.x-accept_eula" id="id-.glyptodon-guacamoledbpostgresv1.x-accept_eula"></a>

The `ACCEPT_EULA` environment variable must be set to "Y" to indicate your acceptance of the [Keeper Connection Manager EULA](https://www.keepersecurity.com/en_GB/termsofuse.html?t=v). This Docker image may not be used except under the terms of the EULA.

#### `POSTGRES_PASSWORD` <a href="#id-.glyptodon-guacamoledbpostgresv1.x-guacamole_database" id="id-.glyptodon-guacamoledbpostgresv1.x-guacamole_database"></a>

The PostgreSQL administrator password.

#### `GUACAMOLE_DATABASE` <a href="#id-.glyptodon-guacamoledbpostgresv1.x-guacamole_database" id="id-.glyptodon-guacamoledbpostgresv1.x-guacamole_database"></a>

The name of the database to create and initialized for use with Apache Guacamole. This environment variable ultimately maps to the `POSTGRES_DB` environment variable of the official PostgreSQL image. If omitted, the default value defined by the official PostgreSQL image will be used.

The `GUACAMOLE_DATABASE` variable is provided here for consistency with the other Guacamole-specific variables and may be omitted if `POSTGRES_DB` is provided.

#### `GUACAMOLE_ADMIN_PASSWORD` <a href="#id-.glyptodon-guacamoledbmysqlv1.x-guacamole_usernameandguacamole_password" id="id-.glyptodon-guacamoledbmysqlv1.x-guacamole_usernameandguacamole_password"></a>

This is the Administrator password for the `guacadmin` user.

#### `GUACAMOLE_USERNAME` and `GUACAMOLE_PASSWORD` <a href="#id-.glyptodon-guacamoledbpostgresv1.x-guacamole_usernameandguacamole_password" id="id-.glyptodon-guacamoledbpostgresv1.x-guacamole_usernameandguacamole_password"></a>

The username and password to use for the PostgreSQL database user specific to the Guacamole web application. This pair of variables differ from the `POSTGRES_USER` and `POSTGRES_PASSWORD` environment variables provided by [the official PostgreSQL image](http://confluence.glyptodon.com/_/postgres) in that the created user has limited privileges, being granted only what privileges are absolutely required for Guacamole to run.

The `GUACAMOLE_USERNAME` and `GUACAMOLE_PASSWORD` are not strictly required, as the user created with `POSTGRES_USER` and `POSTGRES_PASSWORD` may be used instead, however they are **strongly recommended** to ensure the [Principle of Least Privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege) is followed.

### Docker secrets <a href="#id-.glyptodon-guacamoledbpostgresv1.x-dockersecrets" id="id-.glyptodon-guacamoledbpostgresv1.x-dockersecrets"></a>

Rather than pass data directly in environment variables, a `_FILE` suffix may be added to any environment variable supported by this image to force that variable to be read from the named file within the container. As Docker secrets store sensitive data within files beneath `/run/secrets/` within the container, this can be used to load sensitive data from Docker secrets.

For example, to load the username and password for the limited-privilege user specific to the Guacamole web application from Docker secrets:

```
docker run --name some-guacamole-db \
    -e ACCEPT_EULA=Y \
    -e GUACAMOLE_DATABASE=guacamole_db \
    -e POSTGRES_PASSWORD=some_password \
    -e GUACAMOLE_ADMIN_PASSWORD=some_password \
    -e GUACAMOLE_USERNAME_FILE=/run/secrets/postgres-username \
    -e GUACAMOLE_PASSWORD_FILE=/run/secrets/postgres-password \
    -d keeper/guacamole-db-postgres
```