Skip to content

Commit 9a3933b

Browse files
soedirgosoedirgo
authored
Merge branch 'develop' into feat/event-trigger-owner
2 parents 621bc5d + 8510360 commit 9a3933b

File tree

12 files changed

+615
-15
lines changed

12 files changed

+615
-15
lines changed

‎.github/workflows/qemu-image-build.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626
- name: Set PostgreSQL versions - only builds pg17 atm
2727
id: set-versions
2828
run: |
29-
VERSIONS=$(nix run nixpkgs#yq -- '.postgres_major[1]' ansible/vars.yml | nix run nixpkgs#jq -- -R -s -c 'split("\n")[:-1]')
29+
VERSIONS=$(nix run nixpkgs#yq -- '.postgres_major[2]' ansible/vars.yml | nix run nixpkgs#jq -- -R -s -c 'split("\n")[:-1]')
3030
echo "postgres_versions=$VERSIONS" >> $GITHUB_OUTPUT
3131
3232
build:

‎ansible/files/adminapi.service.j2‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ User=adminapi
88
Restart=always
99
RestartSec=3
1010
Environment="AWS_USE_DUALSTACK_ENDPOINT=true"
11+
{% if qemu_mode is defined and qemu_mode %}
12+
Environment="AWS_SDK_LOAD_CONFIG=true"
13+
{% endif %}
1114

1215
[Install]
1316
WantedBy=multi-user.target

‎ansible/playbook.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@
8282
import_tasks: tasks/fix_ipv6_ndisc.yml
8383
tags:
8484
- install-supabase-internal
85-
when: debpkg_mode or nixpkg_mode
85+
when: (debpkg_mode or nixpkg_mode) and (qemu_mode is undefined)
8686

8787
- name: Start Postgres Database without Systemd
8888
become: yes

‎ansible/tasks/setup-postgres.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -255,7 +255,7 @@
255255
LOCALE_ARCHIVE: /usr/lib/locale/locale-archive
256256
vars:
257257
ansible_command_timeout: 60
258-
when: stage2_nix and is_psql_oriole or is_psql_17
258+
when: stage2_nix and (is_psql_oriole or is_psql_17)
259259

260260
- name: copy PG systemd unit
261261
template:

‎ansible/vars.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -47,14 +47,13 @@ kong_deb_checksum: sha1:2086f6ccf8454fe64435252fea4d29d736d7ec61
4747
nginx_release: 1.22.0
4848
nginx_release_checksum: sha1:419efb77b80f165666e2ee406ad8ae9b845aba93
4949

50-
5150
postgres_exporter_release: "0.15.0"
5251
postgres_exporter_release_checksum:
5352
arm64: sha256:29ba62d538b92d39952afe12ee2e1f4401250d678ff4b354ff2752f4321c87a0
5453
amd64: sha256:cb89fc5bf4485fb554e0d640d9684fae143a4b2d5fa443009bd29c59f9129e84
5554

56-
adminapi_release: 0.76.0
57-
adminmgr_release: 0.24.1
55+
adminapi_release: 0.77.0
56+
adminmgr_release: 0.25.0
5857

5958
vector_x86_deb: "https://packages.timber.io/vector/0.22.3/vector_0.22.3-1_amd64.deb"
6059
vector_arm_deb: "https://packages.timber.io/vector/0.22.3/vector_0.22.3-1_arm64.deb"

‎ebssurrogate/scripts/qemu-bootstrap-nix.sh‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ callbacks_enabled = timer, profile_tasks, profile_roles
3535
EOF
3636
# Run Ansible playbook
3737
export ANSIBLE_LOG_PATH=/tmp/ansible.log && export ANSIBLE_REMOTE_TEMP=/mnt/tmp
38-
ansible-playbook ./ansible/playbook.yml --extra-vars '{"nixpkg_mode": true, "debpkg_mode": false, "stage2_nix": false}' \
38+
ansible-playbook ./ansible/playbook.yml --extra-vars '{"nixpkg_mode": true, "debpkg_mode": false, "stage2_nix": false, "qemu_mode": true}' \
3939
--extra-vars "postgresql_version=postgresql_${POSTGRES_MAJOR_VERSION}" \
4040
--extra-vars "postgresql_major_version=${POSTGRES_MAJOR_VERSION}" \
4141
--extra-vars "postgresql_major=${POSTGRES_MAJOR_VERSION}" \
@@ -106,7 +106,7 @@ EOF
106106

107107
function clean_legacy_things {
108108
# removes things that are bundled for legacy reasons, but we can start without for our newer artifacts
109-
apt-get unmark zlib1g* # TODO (darora): need to make sure that there aren't other things that still need this
109+
apt-mark auto zlib1g* # TODO (darora): need to make sure that there aren't other things that still need this
110110
apt-get -y purge kong
111111
apt-get autoremove -y
112112
}
@@ -135,7 +135,9 @@ function clean_system {
135135
mkdir /var/log/sysstat
136136

137137
chown -R postgres:postgres /var/log/wal-g
138-
chmod -R 0300 /var/log/wal-g
138+
# moving up fixes from init scripts
139+
chmod -R 0310 /var/log/wal-g
140+
chmod 0340 /var/log/wal-g/pitr.log
139141

140142
# # audit logs directory for apparmor
141143
mkdir /var/log/audit

‎nix/ext/orioledb.nix‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,12 @@ stdenv.mkDerivation rec {
66
src = fetchFromGitHub {
77
owner = "orioledb";
88
repo = "orioledb";
9-
rev = "beta9";
10-
sha256 = "sha256-z2EHWsY+hhtnYzAxOl2PWjqfyJ+wp9SCau5LKPT2ec0=";
9+
rev = "beta10";
10+
sha256 = "sha256-O4OTi8ickylVXE9FURm5R++A+l15Z22YLna7OVzVMjc=";
1111
};
12-
version = "beta9";
12+
version = "beta10";
1313
buildInputs = [ curl libkrb5 postgresql python3 openssl ];
14-
buildPhase = "make USE_PGXS=1 ORIOLEDB_PATCHSET_VERSION=5";
14+
buildPhase = "make USE_PGXS=1 ORIOLEDB_PATCHSET_VERSION=6";
1515
installPhase = ''
1616
runHook preInstall
1717

‎nix/postgresql/orioledb-17.nix‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
import ./generic.nix {
2-
version = "17_5";
3-
hash = "sha256-OgXLpFanNp+ngPFKyCEDUFvIEWQ9nK/1csUO9lVTXaQ=";
2+
version = "17_6";
3+
hash = "sha256-HbuTcXNanFOl9YfvlSzQJon8CfAhc8TFwo/y7jXy51w=";
44
}

‎nix/tests/expected/auth.out‎

Lines changed: 180 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,180 @@
1+
-- auth schema owner
2+
select
3+
n.nspname as schema_name,
4+
r.rolname as owner
5+
from
6+
pg_namespace n
7+
join
8+
pg_roles r on n.nspowner = r.oid
9+
where
10+
n.nspname = 'auth';
11+
schema_name | owner
12+
-------------+----------------
13+
auth | supabase_admin
14+
(1 row)
15+
16+
-- attributes of the supabase_auth_admin
17+
select
18+
rolcreaterole ,
19+
rolcanlogin ,
20+
rolsuper ,
21+
rolinherit ,
22+
rolcreatedb ,
23+
rolreplication ,
24+
rolconnlimit ,
25+
rolbypassrls ,
26+
rolvaliduntil
27+
from pg_roles r
28+
where r.rolname = 'supabase_auth_admin';
29+
rolcreaterole | rolcanlogin | rolsuper | rolinherit | rolcreatedb | rolreplication | rolconnlimit | rolbypassrls | rolvaliduntil
30+
---------------+-------------+----------+------------+-------------+----------------+--------------+--------------+---------------
31+
t | t | f | f | f | f | -1 | f |
32+
(1 row)
33+
34+
select
35+
rolconfig
36+
from pg_roles r
37+
where r.rolname = 'supabase_auth_admin';
38+
rolconfig
39+
---------------------------------------------------------------------------------
40+
{search_path=auth,idle_in_transaction_session_timeout=60000,log_statement=none}
41+
(1 row)
42+
43+
-- auth schema tables with owners and rls policies
44+
select
45+
ns.nspname as schema_name,
46+
c.relname as table_name,
47+
r.rolname as owner,
48+
c.relrowsecurity as rls_enabled,
49+
string_agg(p.polname, ', ' order by p.polname) as rls_policies
50+
from
51+
pg_class c
52+
join
53+
pg_namespace ns on c.relnamespace = ns.oid
54+
join
55+
pg_roles r on c.relowner = r.oid
56+
left join
57+
pg_policy p on p.polrelid = c.oid
58+
where
59+
ns.nspname = 'auth'
60+
and c.relkind = 'r'
61+
group by
62+
ns.nspname, c.relname, r.rolname, c.relrowsecurity
63+
order by
64+
c.relname;
65+
schema_name | table_name | owner | rls_enabled | rls_policies
66+
-------------+-------------------+---------------------+-------------+--------------
67+
auth | audit_log_entries | supabase_auth_admin | f |
68+
auth | instances | supabase_auth_admin | f |
69+
auth | refresh_tokens | supabase_auth_admin | f |
70+
auth | schema_migrations | supabase_auth_admin | f |
71+
auth | users | supabase_auth_admin | f |
72+
(5 rows)
73+
74+
-- auth indexes with owners
75+
select
76+
ns.nspname as table_schema,
77+
t.relname as table_name,
78+
i.relname as index_name,
79+
r.rolname as index_owner
80+
from
81+
pg_class t
82+
join
83+
pg_namespace ns on t.relnamespace = ns.oid
84+
join
85+
pg_index idx on t.oid = idx.indrelid
86+
join
87+
pg_class i on idx.indexrelid = i.oid
88+
join
89+
pg_roles r on i.relowner = r.oid
90+
where
91+
ns.nspname = 'auth'
92+
order by
93+
t.relname, i.relname;
94+
table_schema | table_name | index_name | index_owner
95+
--------------+-------------------+----------------------------------------+---------------------
96+
auth | audit_log_entries | audit_log_entries_pkey | supabase_auth_admin
97+
auth | audit_log_entries | audit_logs_instance_id_idx | supabase_auth_admin
98+
auth | instances | instances_pkey | supabase_auth_admin
99+
auth | refresh_tokens | refresh_tokens_instance_id_idx | supabase_auth_admin
100+
auth | refresh_tokens | refresh_tokens_instance_id_user_id_idx | supabase_auth_admin
101+
auth | refresh_tokens | refresh_tokens_pkey | supabase_auth_admin
102+
auth | refresh_tokens | refresh_tokens_token_idx | supabase_auth_admin
103+
auth | schema_migrations | schema_migrations_pkey | supabase_auth_admin
104+
auth | users | users_email_key | supabase_auth_admin
105+
auth | users | users_instance_id_email_idx | supabase_auth_admin
106+
auth | users | users_instance_id_idx | supabase_auth_admin
107+
auth | users | users_pkey | supabase_auth_admin
108+
(12 rows)
109+
110+
-- auth schema functions with owners
111+
select
112+
n.nspname as schema_name,
113+
p.proname as function_name,
114+
r.rolname as owner
115+
from
116+
pg_proc p
117+
join
118+
pg_namespace n on p.pronamespace = n.oid
119+
join
120+
pg_roles r on p.proowner = r.oid
121+
where
122+
n.nspname = 'auth'
123+
order by
124+
p.proname;
125+
schema_name | function_name | owner
126+
-------------+---------------+---------------------
127+
auth | email | supabase_auth_admin
128+
auth | role | supabase_auth_admin
129+
auth | uid | supabase_auth_admin
130+
(3 rows)
131+
132+
-- roles which have USAGE on the auth schema
133+
select
134+
n.nspname as schema_name,
135+
r.rolname as role_name,
136+
a.privilege_type
137+
from
138+
pg_namespace n
139+
cross join lateral aclexplode(n.nspacl) as a
140+
join
141+
pg_roles r on a.grantee = r.oid
142+
where
143+
n.nspname = 'auth'
144+
and a.privilege_type = 'USAGE'
145+
order by
146+
r.rolname;
147+
schema_name | role_name | privilege_type
148+
-------------+---------------------+----------------
149+
auth | anon | USAGE
150+
auth | authenticated | USAGE
151+
auth | dashboard_user | USAGE
152+
auth | postgres | USAGE
153+
auth | service_role | USAGE
154+
auth | supabase_admin | USAGE
155+
auth | supabase_auth_admin | USAGE
156+
(7 rows)
157+
158+
-- roles which have CREATE on the auth schema
159+
select
160+
n.nspname as schema_name,
161+
r.rolname as role_name,
162+
a.privilege_type
163+
from
164+
pg_namespace n
165+
cross join lateral aclexplode(n.nspacl) as a
166+
join
167+
pg_roles r on a.grantee = r.oid
168+
where
169+
n.nspname = 'auth'
170+
and a.privilege_type = 'CREATE'
171+
order by
172+
r.rolname;
173+
schema_name | role_name | privilege_type
174+
-------------+---------------------+----------------
175+
auth | dashboard_user | CREATE
176+
auth | postgres | CREATE
177+
auth | supabase_admin | CREATE
178+
auth | supabase_auth_admin | CREATE
179+
(4 rows)
180+

0 commit comments

Comments
 (0)