feat: vault sans pgsodium

[soedirgo]

Needs https://github.com/supabase/infrastructure/pull/20621 to be deployed first

Updates Vault to 0.3.1 which no longer requires pgsodium. Also omits pgsodium from the list of extensions that are automatically installed on new projects.

Tested logical backup & restore and pg_upgrade flows locally.

[samrose]

@soedirgo it also looks like you need to actually deactivate pgsodium extension from psql bundle

probably something like

git diff
diff --git a/ansible/files/postgresql_config/postgresql.conf.j2 b/ansible/files/postgresql_config/postgresql.conf.j2
index 1604d94f..28130912 100644
--- a/ansible/files/postgresql_config/postgresql.conf.j2
+++ b/ansible/files/postgresql_config/postgresql.conf.j2
@@ -688,7 +688,7 @@ default_text_search_config = 'pg_catalog.english'
 #local_preload_libraries = ''
 #session_preload_libraries = ''
 
-shared_preload_libraries = 'pg_stat_statements, pgaudit, plpgsql, plpgsql_check, pg_cron, pg_net, pgsodium, timescaledb, auto_explain, pg_tle, plan_filter'  # (change requires restart)
+shared_preload_libraries = 'pg_stat_statements, pgaudit, plpgsql, plpgsql_check, pg_cron, pg_net, timescaledb, auto_explain, pg_tle, plan_filter, supabase_vault'    # (change requires restart)
 jit_provider = 'llvmjit'               # JIT library to use
 
 # - Other Defaults -
diff --git a/flake.nix b/flake.nix
index 154352e2..c503c5ca 100644
--- a/flake.nix
+++ b/flake.nix
@@ -126,7 +126,6 @@
           ./nix/ext/pg_plan_filter.nix
           ./nix/ext/pg_net.nix
           ./nix/ext/pg_hashids.nix
-          ./nix/ext/pgsodium.nix
           ./nix/ext/pg_graphql.nix
           ./nix/ext/pg_stat_monitor.nix
           ./nix/ext/pg_jsonschema.nix

Depending on exactly what you need to do here

Also, you may need to revise the migrations, because:

• if I actually remove pgsodium like in the diff above
• and then I run migrations we get this error

Applying: 10000000000000_demote-postgres.sql
Applying: 20211115181400_update-auth-permissions.sql
Applying: 20211118015519_create-realtime-schema.sql
Applying: 20211122051245_update-realtime-permissions.sql
Applying: 20211124212715_update-auth-owner.sql
Applying: 20211130151719_update-realtime-permissions.sql
Applying: 20220118070449_enable-safeupdate-postgrest.sql
Applying: 20220126121436_finer-postgrest-triggers.sql
Applying: 20220224211803_fix-postgrest-supautils.sql
Applying: 20220317095840_pg_graphql.sql
Applying: 20220321174452_fix-postgrest-alter-type-event-trigger.sql
Applying: 20220322085208_gotrue-session-limit.sql
Applying: 20220404205710_pg_graphql-on-by-default.sql
Applying: 20220609081115_grant-supabase-auth-admin-and-supabase-storage-admin-to-postgres.sql
Applying: 20220613123923_pg_graphql-pg-dump-perms.sql
Applying: 20220713082019_pg_cron-pg_net-temp-perms-fix.sql
Applying: 20221028101028_set_authenticator_timeout.sql
Applying: 20221103090837_revoke_admin.sql
Applying: 20221207154255_create_vault.sql
Error: pq: required extension "pgsodium" is not installed

[soedirgo]

need to actually deactivate pgsodium extension from psql bundle

We want to keep pgsodium available (for now), but automatically CREATE EXTENSION'd. I think omitting that line would make pgsodium unavailable?

required extension "pgsodium" is not installed

This error still puzzles me - from the looks of it it happens on create extension supabase_vault, which would make sense on the older version of supabase_vault (0.2.8) which has a dependency on pgsodium. But the new supabase_vault (0.3.1) has no dependency on pgsodium, so it shouldn't be spitting out this error...

[samrose]

@soedirgo

This error still puzzles me - from the looks of it it happens on create extension supabase_vault, which would make sense on the older version of supabase_vault (0.2.8) which has a dependency on pgsodium. But the new supabase_vault (0.3.1) has no dependency on pgsodium, so it shouldn't be spitting out this error...

I fixed this error in my pr to this pr

[samrose]

I’ll create a new pr against this branch to try and continue fixing the testdb issue

[soedirgo]

CI failures have been fixed (thanks Sam 🙏 ) ready to merge now