Harden security

utilities/prosody/manage_prosody_container.sh

@@ -3,6 +3,7 @@ set -euo pipefail
 
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 STACK_ENV="${STACK_ENV:-$ROOT_DIR/stack.env}"
+ENSURE_XMPP_SECRET_SCRIPT="$ROOT_DIR/utilities/prosody/ensure_xmpp_secret.sh"
 
 if [[ -f "$STACK_ENV" ]]; then
   set -a
@@ -10,6 +11,11 @@ if [[ -f "$STACK_ENV" ]]; then
   set +a
 fi
 
+if [[ -x "$ENSURE_XMPP_SECRET_SCRIPT" ]]; then
+  XMPP_SECRET="$("$ENSURE_XMPP_SECRET_SCRIPT" "$STACK_ENV")"
+  export XMPP_SECRET
+fi
+
 STACK_ID="${GIA_STACK_ID:-${STACK_ID:-}}"
 STACK_ID="$(echo "$STACK_ID" | tr -cs 'a-zA-Z0-9._-' '-' | sed 's/^-*//; s/-*$//')"
 
@@ -29,21 +35,41 @@ PROSODY_CONFIG_FILE="${QUADLET_PROSODY_CONFIG_FILE:-$ROOT_DIR/utilities/prosody/
 PROSODY_CERTS_DIR="${QUADLET_PROSODY_CERTS_DIR:-$ROOT_DIR/.podman/gia_prosody_certs}"
 PROSODY_DATA_DIR="${QUADLET_PROSODY_DATA_DIR:-$ROOT_DIR/.podman/gia_prosody_data}"
 PROSODY_LOGS_DIR="${QUADLET_PROSODY_LOGS_DIR:-$ROOT_DIR/.podman/gia_prosody_logs}"
+PROSODY_IMAGE="${PROSODY_IMAGE:-docker.io/prosody/prosody-alpine:latest}"
 
 mkdir -p "$PROSODY_CERTS_DIR" "$PROSODY_DATA_DIR" "$PROSODY_LOGS_DIR"
 
 up() {
+  local run_args=()
+  local pod_state=""
+  if podman pod exists "$POD_NAME"; then
+    pod_state="$(podman pod inspect "$POD_NAME" --format '{{.State}}' 2>/dev/null || true)"
+    if [[ "$pod_state" == "Running" ]]; then
+      run_args+=(--pod "$POD_NAME")
+    else
+      echo "Warning: pod '$POD_NAME' state is '$pod_state'; starting $PROSODY_CONTAINER standalone with explicit ports." >&2
+      run_args+=(-p 5222:5222 -p 5269:5269 -p 5280:5280 -p 8888:8888)
+    fi
+  else
+    echo "Warning: pod '$POD_NAME' not found; starting $PROSODY_CONTAINER standalone with explicit ports." >&2
+    run_args+=(-p 5222:5222 -p 5269:5269 -p 5280:5280 -p 8888:8888)
+  fi
   podman run -d \
     --replace \
     --name "$PROSODY_CONTAINER" \
-    --pod "$POD_NAME" \
+    "${run_args[@]}" \
+    --env-file "$STACK_ENV" \
     -v "$PROSODY_CONFIG_FILE:/etc/prosody/prosody.cfg.lua:ro" \
     -v "$PROSODY_CERTS_DIR:/etc/prosody/certs" \
     -v "$PROSODY_DATA_DIR:/var/lib/prosody" \
     -v "$PROSODY_LOGS_DIR:/var/log/prosody" \
     -v "$ROOT_DIR:/code" \
-    docker.io/prosody/prosody:0.12 >/dev/null
-  echo "Started $PROSODY_CONTAINER in pod $POD_NAME"
+    "$PROSODY_IMAGE" >/dev/null
+  if [[ " ${run_args[*]} " == *" --pod "* ]]; then
+    echo "Started $PROSODY_CONTAINER in pod $POD_NAME"
+  else
+    echo "Started $PROSODY_CONTAINER standalone (not attached to pod $POD_NAME)"
+  fi
 }
 
 down() {