fix: correct usage of POSTGRES_JNDI_ENABLED

[buehner]

fix: correct usage of POSTGRES_JNDI_ENABLED

Background

The PostgreSQL JNDI configuration was moved some time ago from a separate context.xml into server.xml (and server-https.xml). As a side effect, POSTGRES_JNDI_ENABLED became effectively a no-op: the <Resource> definition was hard-coded in server.xml, and the only remaining code path that still evaluated the variable merely tried to copy a (no longer existing) context.xml.

As a result, the JNDI resource was always created — even when POSTGRES_JNDI_ENABLED was unset or false.

Changes

• config/server.xml and config/server-https.xml: The <Resource> block for the PostgreSQL JNDI DataSource is now wrapped with marker comments:

  <!-- POSTGRES_JNDI_RESOURCE_BEGIN (stripped by startup.sh when POSTGRES_JNDI_ENABLED != true) -->
  ...
  <!-- POSTGRES_JNDI_RESOURCE_END -->

• startup.sh:
  • Removed the dead code path that attempted to copy a context.xml.
  • After rendering server.xml, the marked JNDI block is stripped via sed unless POSTGRES_JNDI_ENABLED is set to true.
• README.md: Cleaned up the note referring to the (no longer existing) context.xml.

Behavior after the fix

POSTGRES_JNDI_ENABLED	Result in server.xml
true	JNDI <Resource> is kept
unset / false / anything else	JNDI <Resource> is removed

How to test

1. Start a container without POSTGRES_JNDI_ENABLED → $CATALINA_HOME/conf/server.xml must not contain any <Resource name="jdbc/postgres" .../> entry.
2. Start a container with POSTGRES_JNDI_ENABLED=true and the other POSTGRES_JNDI_* variables set → the <Resource> block must be present and populated with the provided values; GeoServer can reference the DataSource via java:comp/env/jdbc/postgres.
3. Repeat both checks with HTTPS_ENABLED=true (which uses server-https.xml as the template).

Breaking changes

None. Users who previously set POSTGRES_JNDI_ENABLED=true will get the exact same resource as before. Users who did not set the variable were unintentionally getting a JNDI resource anyway; this PR fixes that.

[Copilot]

Pull request overview

This PR restores POSTGRES_JNDI_ENABLED as an effective toggle by ensuring the PostgreSQL JNDI <Resource> is only present in the generated Tomcat server.xml when explicitly enabled, aligning runtime behavior with the documented environment variable contract.

Changes:

• Wraps the PostgreSQL JNDI <Resource> blocks in config/server.xml and config/server-https.xml with begin/end marker comments.
• Removes the dead context.xml override path and strips the marked JNDI block from the rendered server.xml when POSTGRES_JNDI_ENABLED != true.
• Updates README documentation to remove references to the (now non-existent) context.xml.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
startup.sh	Removes legacy context.xml handling and strips the marked JNDI block from the rendered server.xml when not enabled.
README.md	Updates documentation to reflect that JNDI settings now live in server.xml rather than context.xml.
config/server.xml	Adds marker comments around the PostgreSQL JNDI <Resource> so it can be conditionally removed at startup.
config/server-https.xml	Adds the same marker comments for the HTTPS server template.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

startup.sh:9

• The comment refers to POSTGRES_JNDI_PASSWORD, but that variable doesn't exist in the repo (the documented env var is POSTGRES_PASSWORD). This can mislead users/maintainers reading the script.

# <!-- POSTGRES_JNDI_RESOURCE_BEGIN --> ... <!-- POSTGRES_JNDI_RESOURCE_END -->
# markers in the default server.xml / server-https.xml templates. Applying the
# filter before envsubst ensures that credentials (e.g. POSTGRES_JNDI_PASSWORD)
# are never substituted into the rendered file when JNDI is disabled.