Sam/custom pam

.github/workflows/nix-build.yml

@@ -52,6 +52,12 @@ jobs:
           sudo -E python -c "import os; file = open('/etc/nix/nix-secret-key', 'w'); file.write(os.environ['NIX_SIGN_SECRET_KEY']); file.close()"
         env:
           NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }}
+      - name: Setup SSH for deploy key
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.GK_DEPLOY_KEY }}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan github.com >> ~/.ssh/known_hosts
       - name: Setup cache script
         if: ${{ github.secret_source == 'Actions' }}
         run: |

ansible/tasks/setup-postgres.yml

@@ -139,6 +139,21 @@
     group: postgres
   when: debpkg_mode or nixpkg_mode
 
+- name: Check if psql_version is psql_15
+  set_fact:
+    is_psql_15: "{{ psql_version in ['psql_15'] }}"
+
+- name: create placeholder pam config
+  file:
+    path: '/etc/pam.d/{{ item }}'
+    state: touch
+    owner: postgres
+    group: postgres
+    mode: 0664
+  with_items:
+    - 'postgresql'
+  when: (debpkg_mode or nixpkg_mode) and not is_psql_15
+
 # Add pg_hba.conf
 - name: import pg_hba.conf
   template:

flake.nix

@@ -13,7 +13,9 @@
     treefmt-nix.inputs.nixpkgs.follows = "nixpkgs";
     git-hooks.url = "github:cachix/git-hooks.nix";
     git-hooks.inputs.nixpkgs.follows = "nixpkgs";
-    nixpkgs-go124.url = "github:Nixos/nixpkgs/d2ac4dfa61fba987a84a0a81555da57ae0b9a2b0";
+    nixpkgs-go124.url = "github:Nixos/nixpkgs/3b9f00d7a7bf68acd4c4abb9d43695afb04e03a5";
+    gatekeeper.url = "git+ssh://[email protected]/supabase/jit-db-gatekeeper?ref=sam/add-flake-parts&rev=34ba4a222c15b2480b837bbb3076508f36c9296f";
+    gatekeeper.inputs.nixpkgs.follows = "nixpkgs";
   };
 
   outputs =

nix/overlays/default.nix

@@ -51,5 +51,16 @@
     buildPgrxExtension_0_14_3 = prev.buildPgrxExtension.override {
       cargo-pgrx = final.cargo-pgrx.cargo-pgrx_0_14_3;
     };
+
+    # place the gatekeeper module in the expected libpam location
+    gatekeeper = self.packages.${final.system}.gatekeeper;
+    linux-pam = prev.linux-pam.overrideAttrs (old: {
+      postInstall =
+        (old.postInstall or "")
+        + ''
+          mkdir -p $out/lib/security
+          cp ${final.gatekeeper}/lib/security/*.so $out/lib/security/
+        '';
+    });
   };
 }

nix/packages/default.nix

@@ -1,6 +1,9 @@
 { self, inputs, ... }:
 {
-  imports = [ ./postgres.nix ];
+  imports = [
+    ./postgres.nix
+    ./gatekeeper.nix
+  ];
   perSystem =
     {
       inputs',

nix/packages/gatekeeper.nix

@@ -0,0 +1,12 @@
+{ inputs, ... }:
+{
+  perSystem =
+    { system, ... }:
+    let
+
+      go124 = inputs.nixpkgs-go124.legacyPackages.${system}.go_1_24;
+    in
+    {
+      packages.gatekeeper = inputs.gatekeeper.lib.${system}.makeGatekeeper { go = go124; };
+    };
+}