fix: correct usage of POSTGRES_JNDI_ENABLED

README.md

@@ -177,15 +177,14 @@ To enable a PostgreSQL JNDI resource, provide the following environment variable
 
 In geoserver, you can then reference this JNDI resource using the name `java:comp/env/jdbc/postgres` (if using default).
 
-Note: previously you could tweak the JNDI settings in a custom `context.xml` (see below), but its contents are now included in `server.xml`.
+Note: previously the JNDI settings lived in a custom `context.xml`, but their contents are now included in `server.xml`.
 
 
 ## How to use custom (tomcat) configuration files
 
 This image provides default (tomcat) configurations that are located in the `./config/` subdir.
 
 * `server.xml` (security hardened version by default)
-* ~context.xml~ (now included into `server.xml`, previously used for JNDI settings)
 
 In case you want to fully overwrite such a config file, you can do so by mounting it to the `/opt/config_overrides/` directory of a container.
 The `startup.sh` script will then copy (and overwrite) these files to the catalina conf directory before starting tomcat.

config/server-https.xml

@@ -175,6 +175,7 @@
                prefix="localhost_access_log" suffix=".txt"
                pattern="%h %l %u %t "%r" %s %b" />
           <Context antiResourceLocking="false" override="true" docBase="geoserver" privileged="true" path="/${WEBAPP_CONTEXT}">
+               <!-- POSTGRES_JNDI_RESOURCE_BEGIN (stripped by startup.sh when POSTGRES_JNDI_ENABLED != true) -->
                <Resource name="${POSTGRES_JNDI_RESOURCE_NAME}"
                          auth="Container"
                          type="javax.sql.DataSource"
@@ -193,6 +194,7 @@
                          validationQuery="SELECT 1"
                          rollbackOnReturn="true"
                />
+               <!-- POSTGRES_JNDI_RESOURCE_END -->
           </Context>
       </Host>
     </Engine>

config/server.xml

@@ -182,6 +182,7 @@
                        pattern="%h %l %u %t "%r" %s %b" />
 
                 <Context antiResourceLocking="false" override="true" docBase="geoserver" privileged="true" path="/${WEBAPP_CONTEXT}">
+                    <!-- POSTGRES_JNDI_RESOURCE_BEGIN (stripped by startup.sh when POSTGRES_JNDI_ENABLED != true) -->
                     <Resource name="${POSTGRES_JNDI_RESOURCE_NAME}"
                             auth="Container"
                             type="javax.sql.DataSource"
@@ -200,6 +201,7 @@
                             validationQuery="SELECT 1"
                             rollbackOnReturn="true"
                     />
+                    <!-- POSTGRES_JNDI_RESOURCE_END -->
                 </Context>
             </Host>
         </Engine>

startup.sh

@@ -99,7 +99,7 @@ total_count=$((ttf_count + ttc_count))
 if [ -d "$ADDITIONAL_FONTS_DIR" ] && [ $total_count != 0 ]; then
     [ "$ttf_count" -gt 0 ] && cp "$ADDITIONAL_FONTS_DIR"/*.ttf /usr/share/fonts/truetype/
     [ "$ttc_count" -gt 0 ] && cp "$ADDITIONAL_FONTS_DIR"/*.ttc /usr/share/fonts/truetype/
-    
+
     echo "Installed $total_count ttf/ttc font file(s) from the additional fonts folder"
 fi
 
@@ -173,11 +173,6 @@ if [ "${CORS_ENABLED}" = "true" ]; then
   fi
 fi
 
-if [ "${POSTGRES_JNDI_ENABLED}" = "true" ]; then
-  # Use a custom "context.xml" if the user mounted one into the container
-  copy_custom_config "context.xml"
-fi
-
 # Use a custom "server.xml" if the user mounted one into the container
 copy_custom_config "server.xml"
 
@@ -205,6 +200,14 @@ if [ "${HTTPS_ENABLED}" = "true" ]; then
   envsubst < "${CONFIG_DIR}"/server-https.xml > "${CATALINA_HOME}/conf/server.xml"
 fi
 
+# Strip the PostgreSQL JNDI <Resource> block from server.xml unless JNDI is
+# explicitly enabled. The block is wrapped in
+# <!-- POSTGRES_JNDI_RESOURCE_BEGIN --> ... <!-- POSTGRES_JNDI_RESOURCE_END -->
+# markers in the default server.xml / server-https.xml templates.
+if [ "${POSTGRES_JNDI_ENABLED}" != "true" ]; then
+  sed -i '/POSTGRES_JNDI_RESOURCE_BEGIN/,/POSTGRES_JNDI_RESOURCE_END/d' "$CATALINA_HOME/conf/server.xml"
+fi
+
 # start the tomcat
 # CIS - Tomcat Benchmark recommendations:
 # * Turn off session facade recycling