Skip to content

Commit 7ba98fb

Browse files
za-arthurza-arthur
committed
Merge remote-tracking branch 'origin/develop' into pg_repack_non_superuser
2 parents c51db83 + 9edaf28 commit 7ba98fb

File tree

15 files changed

+70
-340
lines changed

15 files changed

+70
-340
lines changed

‎.github/workflows/nix-build.yml‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,10 @@ jobs:
2424
arch: arm64
2525
- runner: macos-latest
2626
arch: arm64
27+
- runner: macos-13
28+
arch: amd64
2729
runs-on: ${{ matrix.runner }}
28-
30+
timeout-minutes: 180
2931
steps:
3032

3133
- name: Check out code
@@ -40,30 +42,31 @@ jobs:
4042
role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
4143
aws-region: "us-east-1"
4244
output-credentials: true
45+
role-duration-seconds: 7200
4346
- name: write secret key
4447
# use python so we don't interpolate the secret into the workflow logs, in case of bugs
4548
run: |
4649
python -c "import os; file = open('nix-secret-key', 'w'); file.write(os.environ['NIX_SIGN_SECRET_KEY']); file.close()"
4750
env:
4851
NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }}
4952
- name: Log in to Docker Hub
50-
if: matrix.runner != 'macos-latest'
53+
if: matrix.runner != 'macos-latest' && matrix.runner != 'macos-13'
5154
uses: docker/login-action@v2
5255
with:
5356
username: ${{ secrets.DOCKER_USERNAME }}
5457
password: ${{ secrets.DOCKER_PASSWORD }}
5558
- name: Build psql bundle with nix
56-
if: matrix.runner != 'macos-latest'
59+
if: matrix.runner != 'macos-latest' && matrix.runner != 'macos-13'
5760
run: docker build -t base_nix -f docker/nix/Dockerfile .
5861
- name: Run build psql bundle
59-
if: matrix.runner != 'macos-latest'
62+
if: matrix.runner != 'macos-latest' && matrix.runner != 'macos-13'
6063
run: |
6164
docker run -e AWS_ACCESS_KEY_ID=${{ env.AWS_ACCESS_KEY_ID }} \
6265
-e AWS_SECRET_ACCESS_KEY=${{ env.AWS_SECRET_ACCESS_KEY }} \
6366
-e AWS_SESSION_TOKEN=${{ env.AWS_SESSION_TOKEN }} \
6467
base_nix bash -c "./workspace/docker/nix/build_nix.sh"
6568
- name: Build psql bundle on macos
66-
if: matrix.runner == 'macos-latest'
69+
if: matrix.runner == 'macos-latest' || matrix.runner == 'macos-13'
6770
run: |
6871
curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | sh -s -- install --no-confirm \
6972
--extra-conf "substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com" \

‎ansible/files/envoy_config/lds.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -258,6 +258,9 @@ resources:
258258
max_program_size: 150
259259
regex: >-
260260
/auth/v1/(verify|callback|authorize|sso/saml/(acs|metadata|slo)|\.well-known/(openid-configuration|jwks\.json))
261+
request_headers_to_remove:
262+
- apikey
263+
- sb-opk
261264
route:
262265
cluster: gotrue
263266
regex_rewrite:
@@ -271,6 +274,9 @@ resources:
271274
typed_per_filter_config: *ref_0
272275
- match:
273276
prefix: /auth/v1/
277+
request_headers_to_remove:
278+
- apikey
279+
- sb-opk
274280
route:
275281
cluster: gotrue
276282
prefix_rewrite: /
@@ -282,6 +288,7 @@ resources:
282288
present_match: true
283289
request_headers_to_remove:
284290
- apikey
291+
- sb-opk
285292
route:
286293
cluster: postgrest
287294
prefix_rewrite: /
@@ -295,6 +302,7 @@ resources:
295302
prefix: /rest/v1/
296303
request_headers_to_remove:
297304
- apikey
305+
- sb-opk
298306
route:
299307
cluster: postgrest
300308
prefix_rewrite: /
@@ -311,6 +319,7 @@ resources:
311319
present_match: true
312320
request_headers_to_remove:
313321
- apikey
322+
- sb-opk
314323
route:
315324
cluster: postgrest_admin
316325
prefix_rewrite: /
@@ -323,6 +332,7 @@ resources:
323332
prefix: /rest-admin/v1/
324333
request_headers_to_remove:
325334
- apikey
335+
- sb-opk
326336
route:
327337
cluster: postgrest_admin
328338
prefix_rewrite: /
@@ -332,18 +342,25 @@ resources:
332342
header:
333343
key: Content-Profile
334344
value: graphql_public
345+
request_headers_to_remove:
346+
- apikey
347+
- sb-opk
335348
route:
336349
cluster: postgrest
337350
prefix_rewrite: /rpc/graphql
338351
timeout: 125s
339352
- match:
340353
prefix: /admin/v1/
354+
request_headers_to_remove:
355+
- sb-opk
341356
route:
342357
cluster: admin_api
343358
prefix_rewrite: /
344359
timeout: 600s
345360
- match:
346361
prefix: /customer/v1/privileged/
362+
request_headers_to_remove:
363+
- sb-opk
347364
route:
348365
cluster: admin_api
349366
prefix_rewrite: /privileged/
@@ -367,6 +384,8 @@ resources:
367384
treat_missing_header_as_empty: true
368385
- match:
369386
prefix: /metrics/aggregated
387+
request_headers_to_remove:
388+
- sb-opk
370389
route:
371390
cluster: admin_api
372391
prefix_rewrite: /supabase-internal/metrics

‎ansible/files/postgresql_config/supautils.conf.j2‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
11
supautils.extensions_parameter_overrides = '{"pg_cron":{"schema":"pg_catalog"}}'
22
supautils.policy_grants = '{"postgres":["auth.audit_log_entries","auth.identities","auth.refresh_tokens","auth.sessions","auth.users","realtime.messages","storage.buckets","storage.migrations","storage.objects","storage.s3_multipart_uploads","storage.s3_multipart_uploads_parts"]}'
3-
# full list: address_standardizer, address_standardizer_data_us, adminpack, amcheck, autoinc, bloom, btree_gin, btree_gist, citext, cube, dblink, dict_int, dict_xsyn, earthdistance, file_fdw, fuzzystrmatch, hstore, http, hypopg, index_advisor, insert_username, intagg, intarray, isn, lo, ltree, moddatetime, old_snapshot, orioledb, pageinspect, pg_buffercache, pg_cron, pg_freespacemap, pg_graphql, pg_hashids, pg_jsonschema, pg_net, pg_prewarm, pg_repack, pg_stat_monitor, pg_stat_statements, pg_surgery, pg_tle, pg_trgm, pg_visibility, pg_walinspect, pgaudit, pgcrypto, pgjwt, pgroonga, pgroonga_database, pgrouting, pgrowlocks, pgsodium, pgstattuple, pgtap, plcoffee, pljava, plls, plpgsql, plpgsql_check, plv8, postgis, postgis_raster, postgis_sfcgal, postgis_tiger_geocoder, postgis_topology, postgres_fdw, refint, rum, seg, sslinfo, supabase_vault, supautils, tablefunc, tcn, timescaledb, tsm_system_rows, tsm_system_time, unaccent, uuid-ossp, vector, wrappers, xml2
3+
# full list: address_standardizer, address_standardizer_data_us, adminpack, amcheck, autoinc, bloom, btree_gin, btree_gist, citext, cube, dblink, dict_int, dict_xsyn, earthdistance, file_fdw, fuzzystrmatch, hstore, http, hypopg, index_advisor, insert_username, intagg, intarray, isn, lo, ltree, moddatetime, old_snapshot, orioledb, pageinspect, pg_buffercache, pg_cron, pg_freespacemap, pg_graphql, pg_hashids, pg_jsonschema, pg_net, pg_prewarm, pg_repack, pg_stat_monitor, pg_stat_statements, pg_surgery, pg_tle, pg_trgm, pg_visibility, pg_walinspect, pgaudit, pgcrypto, pgjwt, pgmq, pgroonga, pgroonga_database, pgrouting, pgrowlocks, pgsodium, pgstattuple, pgtap, plcoffee, pljava, plls, plpgsql, plpgsql_check, plv8, postgis, postgis_raster, postgis_sfcgal, postgis_tiger_geocoder, postgis_topology, postgres_fdw, refint, rum, seg, sslinfo, supabase_vault, supautils, tablefunc, tcn, timescaledb, tsm_system_rows, tsm_system_time, unaccent, uuid-ossp, vector, wrappers, xml2
44
# omitted because may be unsafe: adminpack, amcheck, file_fdw, lo, old_snapshot, pageinspect, pg_buffercache, pg_freespacemap, pg_surgery, pg_visibility
55
# omitted because deprecated: intagg, xml2
6-
supautils.privileged_extensions = 'address_standardizer, address_standardizer_data_us, autoinc, bloom, btree_gin, btree_gist, citext, cube, dblink, dict_int, dict_xsyn, earthdistance, fuzzystrmatch, hstore, http, hypopg, index_advisor, insert_username, intarray, isn, ltree, moddatetime, orioledb, pg_cron, pg_graphql, pg_hashids, pg_jsonschema, pg_net, pg_partman, pg_repack, pg_stat_monitor, pg_stat_statements, pg_tle, pg_trgm, pg_walinspect, pgaudit, pgcrypto, pgjwt, pg_prewarm, pgmq, pgroonga, pgroonga_database, pgrouting, pgrowlocks, pgstattuple, pgsodium, pgtap, plcoffee, pljava, plls, plpgsql, plpgsql_check, plv8, postgis, postgis_raster, postgis_sfcgal, postgis_tiger_geocoder, postgis_topology, postgres_fdw, refint, rum, seg, sslinfo, supabase_vault, supautils, tablefunc, tcn, timescaledb, tsm_system_rows, tsm_system_time, unaccent, uuid-ossp, vector, wrappers'
6+
# omitted because doesn't require superuser: pgmq
7+
supautils.privileged_extensions = 'address_standardizer, address_standardizer_data_us, autoinc, bloom, btree_gin, btree_gist, citext, cube, dblink, dict_int, dict_xsyn, earthdistance, fuzzystrmatch, hstore, http, hypopg, index_advisor, insert_username, intarray, isn, ltree, moddatetime, orioledb, pg_cron, pg_graphql, pg_hashids, pg_jsonschema, pg_net, pg_prewarm, pg_repack, pg_stat_monitor, pg_stat_statements, pg_tle, pg_trgm, pg_walinspect, pgaudit, pgcrypto, pgjwt, pgroonga, pgroonga_database, pgrouting, pgrowlocks, pgsodium, pgstattuple, pgtap, plcoffee, pljava, plls, plpgsql, plpgsql_check, plv8, postgis, postgis_raster, postgis_sfcgal, postgis_tiger_geocoder, postgis_topology, postgres_fdw, refint, rum, seg, sslinfo, supabase_vault, supautils, tablefunc, tcn, timescaledb, tsm_system_rows, tsm_system_time, unaccent, uuid-ossp, vector, wrappers'
78
supautils.privileged_extensions_custom_scripts_path = '/etc/postgresql-custom/extension-custom-scripts'
89
supautils.privileged_extensions_superuser = 'supabase_admin'
910
supautils.privileged_role = 'postgres'

‎ansible/vars.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,8 @@ postgres_major:
1010

1111
# Full version strings for each major version
1212
postgres_release:
13-
postgres15: "15.8.1.004-repack-2"
13+
postgres15: "15.8.1.007"
14+
postgres16: "16.3.1.013"
1415

1516
# Non Postgres Extensions
1617
pgbouncer_release: "1.19.0"

‎docker/nix/build_nix.sh‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,15 @@ nix --version
55
if [ -d "/workspace" ]; then
66
cd /workspace
77
fi
8-
nix build .#checks.$(nix-instantiate --eval -E builtins.currentSystem | tr -d '"').psql_15 -L --no-link
9-
nix build .#checks.$(nix-instantiate --eval -E builtins.currentSystem | tr -d '"').psql_16 -L --no-link
10-
nix build .#psql_15/bin -o psql_15
11-
nix build .#psql_16/bin -o psql_16
12-
nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./psql_15
13-
nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./psql_16
8+
if [ $(nix-instantiate --eval -E builtins.currentSystem | tr -d '"') == "x86_64-darwin" ]; then
9+
nix build .#checks.$(nix-instantiate --eval -E builtins.currentSystem | tr -d '"').psql_15 -L --no-link
10+
nix build .#psql_15/bin -o psql_15
11+
nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./psql_15
12+
else
13+
nix build .#checks.$(nix-instantiate --eval -E builtins.currentSystem | tr -d '"').psql_15 -L --no-link
14+
nix build .#checks.$(nix-instantiate --eval -E builtins.currentSystem | tr -d '"').psql_16 -L --no-link
15+
nix build .#psql_15/bin -o psql_15
16+
nix build .#psql_16/bin -o psql_16
17+
nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./psql_15
18+
nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./psql_16
19+
fi

‎flake.nix‎

Lines changed: 4 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
system.x86_64-linux
1818
system.aarch64-linux
1919
system.aarch64-darwin
20+
system.x86_64-darwin
2021
];
2122
in
2223
flake-utils.lib.eachSystem ourSystems (system:
@@ -128,8 +129,7 @@
128129
# use, but even if they did, keeping our own copies means that we can
129130
# rollout new versions of these critical things easier without having to
130131
# go through the upstream release engineering process.
131-
ourExtensions = let
132-
baseExtensions = [
132+
ourExtensions = [
133133
./nix/ext/rum.nix
134134
./nix/ext/timescaledb.nix
135135
./nix/ext/pgroonga.nix
@@ -148,10 +148,10 @@
148148
./nix/ext/pg_cron.nix
149149
./nix/ext/pgsql-http.nix
150150
./nix/ext/pg_plan_filter.nix
151+
./nix/ext/pg_net.nix
151152
./nix/ext/pg_hashids.nix
152153
./nix/ext/pgsodium.nix
153154
./nix/ext/pg_graphql.nix
154-
./nix/ext/pg_partman.nix
155155
./nix/ext/pg_stat_monitor.nix
156156
./nix/ext/pg_jsonschema.nix
157157
./nix/ext/pgvector.nix
@@ -162,13 +162,7 @@
162162
./nix/ext/supautils.nix
163163
./nix/ext/plv8.nix
164164
];
165-
166-
# Add pg_net only if NOT on macOS aarch64
167-
pgNetExtension = if (system == "aarch64-darwin")
168-
then []
169-
else [ ./nix/ext/pg_net.nix ];
170165

171-
in baseExtensions ++ pgNetExtension;
172166
#Where we import and build the orioledb extension, we add on our custom extensions
173167
# plus the orioledb option
174168
orioledbExtension = ourExtensions ++ [ ./nix/ext/orioledb.nix ];
@@ -468,8 +462,7 @@
468462
--subst-var-by 'LOCALES' '${localeArchive}' \
469463
--subst-var-by 'EXTENSION_CUSTOM_SCRIPTS_DIR' "$out/extension-custom-scripts" \
470464
--subst-var-by 'MECAB_LIB' '${basePackages.psql_15.exts.pgroonga}/lib/groonga/plugins/tokenizers/tokenizer_mecab.so' \
471-
--subst-var-by 'GROONGA_DIR' '${supabase-groonga}' \
472-
--subst-var-by 'CURRENT_SYSTEM' '${system}'
465+
--subst-var-by 'GROONGA_DIR' '${supabase-groonga}'
473466
474467
chmod +x $out/bin/start-postgres-server
475468
'';

‎nix/ext/pg_net.nix‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,15 @@
22

33
stdenv.mkDerivation rec {
44
pname = "pg_net";
5-
version = "0.11.0";
5+
version = "0.13.0";
66

77
buildInputs = [ curl postgresql ];
88

99
src = fetchFromGitHub {
1010
owner = "supabase";
1111
repo = pname;
1212
rev = "refs/tags/v${version}";
13-
hash = "sha256-XN441jXK1q+I/LZRNwvzbSsebXHgZ8iYsslZvcPFlAs=";
13+
hash = "sha256-FRaTZPCJQPYAFmsJg22hYJJ0+gH1tMdDQoCQgiqEnaA=";
1414
};
1515

1616
env.NIX_CFLAGS_COMPILE = "-Wno-error";

‎nix/ext/plv8.nix‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ stdenv.mkDerivation (finalAttrs: {
120120
description = "V8 Engine Javascript Procedural Language add-on for PostgreSQL";
121121
homepage = "https://plv8.github.io/";
122122
maintainers = with maintainers; [ samrose ];
123-
platforms = [ "x86_64-linux" "aarch64-linux" "aarch64-darwin" ];
123+
platforms = [ "x86_64-linux" "aarch64-linux" "aarch64-darwin" "x86_64-darwin" ];
124124
license = licenses.postgresql;
125125
};
126126
})

0 commit comments

Comments
 (0)