Merge develop

Author: encima

.github/workflows/check-shellscripts.yml

@@ -7,6 +7,10 @@ on:
   pull_request:
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 

.github/workflows/ci.yml

@@ -6,6 +6,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   check-release-version:
     timeout-minutes: 5

.github/workflows/nix-build.yml

@@ -14,6 +14,10 @@ permissions:
   contents: write
   packages: write
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build-run-image:
     strategy:

README.md

@@ -1,14 +1,56 @@
 [Unit]
 Description=Gotrue
 
+# Avoid starting gotrue while cloud-init is running. It makes a lot of changes
+# and I would like to rule out side effects of it running concurrently along
+# side services.
+After=cloud-init.service
+Wants=cloud-init.target
+
+# Given the fact that auth uses SO_REUSEADDR, I want to rule out capabilities
+# being modified between restarts early in boot. This plugs up the scenario that
+# EADDRINUSE errors originate from a previous gotrue process starting without
+# the SO_REUSEADDR flag (due to lacking capability at that point in boot proc)
+# so when the next gotrue starts it can't re-use a slow releasing socket.
+After=apparmor.service
+
+# We want sysctl's to be applied
+After=systemd-sysctl.service
+
+# UFW Is modified by cloud init, but started non-blocking, so configuration
+# could be in-flight while gotrue is starting. I want to ensure future rules
+# that are relied on for security posture are applied before gotrue runs.
+After=ufw.service
+
+# We need networking & resolution, auth uses the Go DNS resolver (not libc)
+# so it's possible `localhost` resolution could be unstable early in startup. We
+# care about this because SO_REUSEADDR eligibility checks the tuple
+# (proto, family, addr, port) meaning the AF_INET (ipv4, ipv6) could affect the
+# binding resulting in a second way for EADDRINUSE errors to surface.
+#
+# Note: We should consider removing localhost usage given `localhost` resolution
+# can often be racey early in boot, can be difficult to debug and offers no real
+# advantage in our infra. At the very least avoiding DNS resolved binding would
+# be a good idea.
+Wants=network-online.target systemd-resolved.service
+After=network-online.target systemd-resolved.service
+
+# Auth server can't start unless postgres is online, lets remove a lot of auth
+# server noise during slow starts by requiring it.
+Wants=postgresql.service
+After=postgresql.service
+
+# Lower start limit ival and burst to prevent the noisy flapping
+StartLimitIntervalSec=10
+StartLimitBurst=5
+
 [Service]
-Type=simple
+Type=exec
 WorkingDirectory=/opt/gotrue
-{% if qemu_mode is defined and qemu_mode %}
-ExecStart=/opt/gotrue/gotrue
-{% else %}
+
+# Both v2 & v3 need a config-dir for reloading support.
 ExecStart=/opt/gotrue/gotrue --config-dir /etc/auth.d
-{% endif %}
+ExecReload=/bin/kill -10 $MAINPID
 
 User=gotrue
 Restart=always
@@ -17,11 +59,36 @@ RestartSec=3
 MemoryAccounting=true
 MemoryMax=50%
 
+# These are the historical location of env files. The /etc/auth.d dir will
+# override them when present.
 EnvironmentFile=-/etc/gotrue.generated.env
 EnvironmentFile=/etc/gotrue.env
 EnvironmentFile=-/etc/gotrue.overrides.env
 
+# Both v2 & v3 support reloading via signals, on linux this is SIGUSR1.
+Environment=GOTRUE_RELOADING_SIGNAL_ENABLED=true
+Environment=GOTRUE_RELOADING_SIGNAL_NUMBER=10
+
+# Both v2 & v3 disable the poller. While gotrue sets it to off by default we
+# defensively set it to false here.
+Environment=GOTRUE_RELOADING_POLLER_ENABLED=false
+
+# Determines how much idle time must pass before triggering a reload. This
+# ensures only 1 reload operation occurs during a burst of config updates.
+Environment=GOTRUE_RELOADING_GRACE_PERIOD_INTERVAL=2s
+
+{% if qemu_mode is defined and qemu_mode %}
+# v3 does not use filesystem notifications for config reloads.
+Environment=GOTRUE_RELOADING_NOTIFY_ENABLED=false
+{% else %}
+# v2 currently relies on notify support, so we will enable it until both v2 / v3
+# have migrated to strictly use signals across all projects. The default is true
+# in gotrue but we will set it defensively here.
+Environment=GOTRUE_RELOADING_NOTIFY_ENABLED=true
+{% endif %}
+
 Slice=services.slice
 
 [Install]
 WantedBy=multi-user.target
+

ansible/files/gotrue.service.j2

@@ -6,9 +6,15 @@ Requires=local-fs.target
 
 [Service]
 Type=oneshot
+{% if qemu_mode is defined and qemu_mode %}
+ExecStart=/opt/supabase-admin-agent/supabase-admin-agent --config /opt/supabase-admin-agent/config.yaml salt --apply --store-result --salt-archive configmanv3-main.tar.gz
+User=root
+Group=root
+{% else %}
 ExecStart=/opt/supabase-admin-agent/supabase-admin-agent --config /opt/supabase-admin-agent/config.yaml salt --apply --store-result
 User=supabase-admin-agent
 Group=supabase-admin-agent
+{% endif %}
 StandardOutput=journal
 StandardError=journal
 StateDirectory=supabase-admin-agent

ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.service renamed to ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.service.j2

@@ -3,11 +3,19 @@ Description=Run Supabase supabase-admin-agent salt on a schedule
 Requires=supabase-admin-agent_salt.service
 
 [Timer]
+{# We're using a significantly lower frequency for triggering this agent on qemu images for the moment. Once we've performed additional validations re: the aggregate impact of running it more frequently, the frequency can be increased. #}
+{% if qemu_mode is defined and qemu_mode %}
+OnCalendar=*-*-* 0,6,12,18:00:00
+RandomizedDelaySec={{ supabase_admin_agent_splay }}
+AccuracySec=1h
+OnBootSec=5m
+Persistent=true
+{% else %}
 OnCalendar=*:0/10
-# Random delay up to {{ supabase_admin_agent_splay }} seconds splay
 RandomizedDelaySec={{ supabase_admin_agent_splay }}
 AccuracySec=1s
 Persistent=true
+{% endif %}
 
 [Install]
 WantedBy=timers.target

ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.timer.j2

@@ -0,0 +1 @@
+supabase_admin_agent_splay_secs: 2h

ansible/qemu-vars.yaml

@@ -1,5 +1,6 @@
 - name: Remove build dependencies
-  apt:
+  ansible.builtin.apt:
+    autoremove: true
     pkg:
       - bison
       - build-essential
@@ -17,5 +18,4 @@
       - ninja-build
       - patch
       - python2
-    state: absent
-    autoremove: yes
+    state: 'absent'

ansible/tasks/clean-build-dependencies.yml

@@ -1,81 +1,104 @@
 - name: PG logging conf
-  template:
-    src: files/postgresql_config/postgresql-csvlog.conf
-    dest: /etc/postgresql/logging.conf
-    group: postgres
+  ansible.builtin.template:
+    dest: '/etc/postgresql/logging.conf'
+    group: 'postgres'
+    src: 'files/postgresql_config/postgresql-csvlog.conf'
 
 - name: UFW - Allow SSH connections
-  ufw:
-    rule: allow
-    name: OpenSSH
+  community.general.ufw:
+    name: 'OpenSSH'
+    rule: 'allow'
 
-- name: UFW - Allow connections to postgreSQL (5432)
-  ufw:
-    rule: allow
-    port: "5432"
+- name: UFW - Allow SSH/PostgreSQL connections
+  community.general.ufw:
+    port: '5432'
+    rule: 'allow'
 
-- name: UFW - Allow connections to postgreSQL (6543)
-  ufw:
-    rule: allow
-    port: "6543"
+- name: UFW - Allow PgBouncer connections
+  community.general.ufw:
+    port: '6543'
+    rule: 'allow'
   tags:
     - install-pgbouncer
 
-- name: UFW - Allow connections to http (80)
-  ufw:
-    rule: allow
-    port: http
-  tags:
-  - install-supabase-internal 
-
-- name: UFW - Allow connections to https (443)
-  ufw:
-    rule: allow
-    port: https
+- name: UFW - Allow HTTP/HTTPS connections
+  community.general.ufw:
+    port: "{{ port_item }}"
+    rule: 'allow'
+  loop:
+    - 'http'
+    - 'https'
+  loop_control:
+    loop_var: 'port_item'
   tags:
-  - install-supabase-internal 
+    - install-supabase-internal
 
 - name: UFW - Deny all other incoming traffic by default
-  ufw:
-    state: enabled
-    policy: deny
-    direction: incoming
+  community.general.ufw:
+    direction: 'incoming'
+    policy: 'deny'
+    state: 'enabled'
 
 - name: Move logrotate files to /etc/logrotate.d/
-  copy:
-    src: "files/logrotate_config/{{ item.file }}"
-    dest: "/etc/logrotate.d/{{ item.file }}"
-    mode: "0700"
-    owner: root
+  ansible.builtin.copy:
+    dest: "/etc/logrotate.d/{{ logrotate_item['file'] }}"
+    mode: '0700'
+    owner: 'root'
+    src: "files/logrotate_config/{{ logrotate_item['file'] }}"
   loop:
-    - { file: "logrotate-postgres-csv.conf" }
-    - { file: "logrotate-postgres.conf" }
-    - { file: "logrotate-walg.conf" }
-    - { file: "logrotate-postgres-auth.conf" }
+    - { file: 'logrotate-postgres.conf' }
+    - { file: 'logrotate-postgres-auth.conf' }
+    - { file: 'logrotate-postgres-csv.conf' }
+    - { file: 'logrotate-walg.conf' }
+  loop_control:
+    loop_var: 'logrotate_item'
 
-- name: Ensure default Postgres logrotate config is removed
-  file:
-    path: /etc/logrotate.d/postgresql-common
-    state: absent
+- name: Ensure default PostgreSQL logrotate config is removed
+  ansible.builtin.file:
+    path: '/etc/logrotate.d/postgresql-common'
+    state: 'absent'
 
 - name: Disable cron access
   copy:
-    src: files/cron.deny
-    dest: /etc/cron.deny
+    dest: '/etc/cron.deny'
+    src: 'files/cron.deny'
+
+- name: Create logrotate.timer.d overrides dir
+  become: true
+  ansible.builtin.file:
+    group: 'root'
+    mode: '0755'
+    owner: 'root'
+    path: '/etc/systemd/system/logrotate.timer.d'
+    state: 'directory'
+
+- name: Configure logrotate.timer.d overrides
+  become: true
+  community.general.ini_file:
+    group: 'root'
+    mode: '0644'
+    no_extra_spaces: true
+    option: 'OnCalendar'
+    owner: 'root'
+    path: '/etc/systemd/system/logrotate.timer.d/override.conf'
+    section: 'Timer'
+    state: 'present'
+    value: '*:0/5'
 
-- name: Configure logrotation to run every hour
-  shell:
-    cmd: |
-        cp  /usr/lib/systemd/system/logrotate.timer /etc/systemd/system/logrotate.timer
-        sed -i -e 's;daily;*:0/5;' /etc/systemd/system/logrotate.timer
-        systemctl reenable logrotate.timer
-  become: yes
+- name: Reload systemd and start logrotate timer
+  become: true
+  ansible.builtin.systemd_service:
+    daemon_reload: true
+    enabled: true
+    name: 'logrotate.timer'
+    state: 'restarted'
 
 - name: import pgsodium_getkey script
-  template:
-    src: files/pgsodium_getkey_readonly.sh.j2
+  ansible.builtin.template:
     dest: "{{ pg_bindir }}/pgsodium_getkey.sh"
-    owner: postgres
-    group: postgres
-    mode: 0700
-  when: debpkg_mode or stage2_nix
+    group: 'postgres'
+    mode: '0700'
+    owner: 'postgres'
+    src: 'files/pgsodium_getkey_readonly.sh.j2'
+  when:
+    - (debpkg_mode or stage2_nix)