…g is false

Honor the existing ServerOptions flag in InitStore so distributed/HStore
can opt out of local backend and admin init. Unset keeps full init for
standalone. Docker maps HG_SERVER_LOAD_FROM_LOCAL_CONFIG to
rest-server.properties.

Fixes apache#3118

…d option

Replace the graph.load_from_local_config gate with a dedicated
init_store.enabled option defaulting to true. That property already means
whether GraphManager loads graph definitions from the local directory, and
existing configs may materialize its declared false default, so reusing it
made an explicit false skip backend and admin initialization for standalone
RocksDB/HBase installs.

The early return also skipped StandardAuthenticator.initAdminUserIfNeeded,
so a Docker PASSWORD was piped into init-store.sh and discarded without
creating the admin, leaving the server on the auth.admin_pa default. In skip
mode the entrypoint now writes PASSWORD to auth.admin_pa instead, and does
not create docker/init_complete since nothing was initialized. The gate is
read back from rest-server.properties so a config mounted without the env
var behaves the same way.

Cover the lifecycle with a main-level test whose graphs directory would fail
if the early exit were missed, and entrypoint smoke tests for default init,
PASSWORD, skip, skip with PASSWORD, mounted property, and false to true
restart. Run those in Docker CI and extend its path filter to the dist
docker directory.

… is true

With init_store.enabled=false the built-in admin account is not created by
init-store, and the only other component that creates it is
GraphManager.initAdminUserIfNeeded(), reached from loadMetaFromPD() and so
gated on usePD. That option defaults to false and the shipped HStore compose
files do not set it, so enabling auth in skip mode would start a server that
enforces authentication with no account to authenticate against.

The entrypoint now refuses that combination and exits with an explanation,
and InitStore logs the same condition for non-Docker installs. Skipping
without auth is unaffected. usePD=true is already the documented pairing for
distributed deployments in the cluster-test rest-server.properties template.

Also align the shell with the server's boolean parsing, which is
case-insensitive, so HG_SERVER_INIT_STORE_ENABLED=FALSE no longer means skip
to Java and run to the entrypoint; read the property through the separators a
properties file allows; escape the password for properties serialization so a
backslash survives; and register backends and plugins only on the enabled
path, since plugin registration runs every plugin's register() and propagates
its failures.

Add entrypoint coverage for these plus a test that disabled mode leaves
backend options unregistered. Note a pre-existing arthas config key mismatch
found while checking the option table.

get_prop was widened to read the `=`, `:` and whitespace separators a
properties file allows, but set_prop still matched only `key=value`. A mounted
`init_store.enabled:false` overridden by HG_SERVER_INIT_STORE_ENABLED therefore
gained a second definition instead of being replaced, and a key defined twice
collects both values into a list that fails the scalar type check while the
config is still loading. Both init-store and server startup would fail. The
same applied to a colon-form auth.admin_pa overridden by PASSWORD.

set_prop now matches the same separators and collapses every existing
definition into one canonical `key=value` line, leaving comments alone. It is
written in awk, so the key and value are matched and emitted literally and no
regex escaping is involved.

Cover colon-form and whitespace-form overrides asserting a single remaining
definition, a colon-form auth.admin_pa override, and that commented defaults
are not treated as definitions. Add a test loading a duplicated key through
HugeConfig to pin why the collapse is required.

…onf in place

Four fixes to the skip path.

InitStore returned zero for a configuration it had just reported as unusable:
init_store.enabled=false with an authenticator set and usePD false means no
component creates the built-in admin. Tarball and init-job callers see only the
exit status, so they continued into an auth-enabled server nobody could reach.
It now fails. Remote auth is exempt, since the auth manager is then an RPC
client and StandardAuthenticator only bootstraps a local one; the entrypoint
guard gains the same exemption, which it was missing.

set_prop replaced the config by rename. A single-file bind mount cannot be
replaced that way, so startup aborted under set -e, and the rename also
discarded the original mode, which matters where auth.admin_pa is written. It
now truncates and rewrites in place, and creates its scratch file under umask
077.

On the skip path enable-auth.sh ran unconditionally, and it appends its keys
without checking, so a mounted config that already enabled auth ended up with
auth.authenticator and auth.graph_store defined twice, which the config parser
rejects. It now runs only when auth is not configured yet, and both keys are
collapsed to single definitions afterwards.

The test guard that skipped two cases without GNU sed was stale once set_prop
moved to awk. Removed, so those cases run everywhere.

Cover the exit status and the remote-auth exemption in the CLI test, and add
entrypoint cases for a mounted auth config, the remote-auth exemption, inode
and mode preservation, and scratch file cleanup.

…n check

enable-auth.sh also adds the authentication block to gremlin-server.yaml and
switches hugegraph.properties to the auth proxy. Skipping it whenever
auth.authenticator already existed left both undone, so a mounted config that
set only that key could start with REST auth on and Gremlin open. Apply each of
the three changes only where it is missing instead, and point the Gremlin block
at whichever authenticator the REST config names.

The admin-account requirement now applies only to the built-in authenticator
and its subclasses. auth.authenticator takes any implementation class, and a
custom LDAP/OIDC/plugin one manages identities elsewhere, so requiring usePD
for it rejected a deployment that works.

get_prop no longer deletes whitespace inside a value, only around it, as the
properties parser does.

- get_prop uses `sed -E` rather than `-r`, which only GNU sed documents
- the appended gremlin-server.yaml block no longer glues itself onto a last
  line that has no trailing newline
- the option description, the InitStore comment and docker/README no longer
  claim every authenticator needs the built-in admin account, which stopped
  being true when the check was narrowed
- InitStoreConfigTest is imported in suite order in UnitTestSuite
- a test asserts the entrypoint's inlined auth block still names everything
  bin/enable-auth.sh does, so the two cannot drift unnoticed

# Conflicts:
#	hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/unit/UnitTestSuite.java

- migrate verified legacy auth volumes without old secrets
- fail closed on REST and Gremlin auth mismatches
- protect config rewrites and reject include flattening
- read administrator passwords from standard input
- verify read-only mounts in Docker CI

…asks for

The Docker auth bootstrap and the ConfigTool it depends on grew into a
second change sharing this branch, which made the diff hard to review as
one idea. They move to a follow-up, leaving the option, the gate, the env
mapping and the init-flag guard here.

Review fixes carried over:

- init-store.sh propagates InitStore's exit status. The trailing
  "Initialization finished." echo made the script exit 0 no matter what,
  so a refused configuration let the entrypoint start a server nobody
  could log in to.
- The entrypoint normalizes HG_SERVER_INIT_STORE_ENABLED and rejects
  values HugeConfig would refuse, instead of recording an initialization
  that never happened.
- The admin bootstrap check no longer requires auth.admin_pa, which
  nothing in the container writes. usePD and the hstore auth graph stay.
- PASSWORD is documented as having no effect once init-store is skipped,
  and the entrypoint warns when both are set.

- Name the actual boolean converter in the entrypoint comment. "BooleanUtils"
  alone is ambiguous: commons-lang3 accepts 0 and 1, the commons-lang 2.x one
  reached through commons-configuration 1.x PropertyConverter does not, and
  the accepted spellings follow the latter.
- Say that the init_complete guard applies to the environment variable, not to
  the property set directly in a mounted rest-server.properties.
- Move InitStoreConfigTest into its own cmd group in UnitTestSuite instead of
  the core one.
- Trim test comments closer to the density of the surrounding suite.

…cord init by result

Two findings from review of the disabled init-store path.

The check now also requires an explicit non-empty auth.admin_pa. Without it a
fresh built-in-auth deployment reaches GraphManager.initAdminUserIfNeeded() on
the PD startup path, which creates the admin from that option's public 'pa'
default while Docker PASSWORD is discarded on this path. The accepted-HStore
test had no admin_pa, so it pinned exactly that case.

The docker init marker is now written by init-store itself, and only when it
initialized. The entrypoint could only decide from its own environment
variable, so a config mounted with init_store.enabled=false was still recorded
as initialized, and setting it back to true later skipped initialization for
good. The marker path is passed in, so callers that do not want one are
unaffected.

…moved

init-store writes the marker now, so a run disabled by a mounted property
records nothing just as one disabled by the environment variable does. The
text still described the entrypoint owning it, and still claimed the mounted
case was unguarded, which the change removed.