nixos/postgresql: drop ensurePermissions, fix ensureUsers for postgresql15

Closes #216989

First of all, a bit of context: in PostgreSQL, newly created users don't
have the CREATE privilege on the public schema of a database even with
`ALL PRIVILEGES` granted via `ensurePermissions` which is how most of
the DB users are currently set up "declaratively"[1]. This means e.g. a
freshly deployed Nextcloud service will break early because Nextcloud
itself cannot CREATE any tables in the public schema anymore.

The other issue here is that `ensurePermissions` is a mere hack. It's
effectively a mixture of SQL code (e.g. `DATABASE foo` is relying on how
a value is substituted in a query. You'd have to parse a subset of SQL
to actually know which object are permissions granted to for a user).

After analyzing the existing modules I realized that in every case with
a single exception[2] the UNIX system user is equal to the db user is
equal to the db name and I don't see a compelling reason why people
would change that in 99% of the cases. In fact, some modules would even
break if you'd change that because the declarations of the system user &
the db user are mixed up[3].

So I decided to go with something new which restricts the ways to use
`ensure*` options rather than expanding those[4]. Effectively this means
that

* The DB user _must_ be equal to the DB name.
* Permissions are granted via `ensureDBOwnerhip` for an attribute-set in
  `ensureUsers`. That way, the user is actually the owner and can
  perform `CREATE`.
* For such a postgres user, a database must be declared in
  `ensureDatabases`.

For anything else, a custom state management should be implemented. This
can either be `initialScript`, doing it manual, outside of the module or
by implementing proper state management for postgresql[5], but the
current state of `ensure*` isn't even declarative, but a convergent tool
which is what Nix actually claims to _not_ do.

Regarding existing setups: there are effectively two options:

* Leave everything as-is (assuming that system user == db user == db
  name): then the DB user will automatically become the DB owner and
  everything else stays the same.

* Drop the `createDatabase = true;` declarations: nothing will change
  because a removal of `ensure*` statements is ignored, so it doesn't
  matter at all whether this option is kept after the first deploy (and
  later on you'd usually restore from backups anyways).

  The DB user isn't the owner of the DB then, but for an existing setup
  this is irrelevant because CREATE on the public schema isn't revoked
  from existing users (only not granted for new users).

[1] not really declarative though because removals of these statements
    are simply ignored for instance: https://github.com/NixOS/nixpkgs/issues/206467
[2] `services.invidious`: I removed the `ensure*` part temporarily
    because it IMHO falls into the category "manage the state on your
    own" (see the commit message). See also
    https://github.com/NixOS/nixpkgs/pull/265857
[3] e.g. roundcube had `"DATABASE ${cfg.database.username}" = "ALL PRIVILEGES";`
[4] As opposed to other changes that are considered a potential fix, but
    also add more things like collation for DBs or passwords that are
    _never_ touched again when changing those.
[5] As suggested in e.g. https://github.com/NixOS/nixpkgs/issues/206467
This commit is contained in:
Maximilian Bosch 2023-11-08 12:50:09 +01:00 committed by Raito Bezarius
parent c42941c549
commit 48459567ae
47 changed files with 176 additions and 153 deletions

View file

@ -165,25 +165,13 @@ in
'';
};
ensurePermissions = mkOption {
type = types.attrsOf types.str;
default = {};
description = lib.mdDoc ''
Permissions to ensure for the user, specified as an attribute set.
The attribute names specify the database and tables to grant the permissions for.
The attribute values specify the permissions to grant. You may specify one or
multiple comma-separated SQL privileges here.
For more information on how to specify the target
and on which privileges exist, see the
[GRANT syntax](https://www.postgresql.org/docs/current/sql-grant.html).
The attributes are used as `GRANT ''${attrValue} ON ''${attrName}`.
'';
example = literalExpression ''
{
"DATABASE \"nextcloud\"" = "ALL PRIVILEGES";
"ALL TABLES IN SCHEMA public" = "ALL PRIVILEGES";
}
ensureDBOwnership = mkOption {
type = types.bool;
default = false;
description = mdDoc ''
Grants the user ownership to a database with the same name.
This database must be defined manually in
[](#opt-services.postgresql.ensureDatabases).
'';
};
@ -338,26 +326,21 @@ in
});
default = [];
description = lib.mdDoc ''
Ensures that the specified users exist and have at least the ensured permissions.
Ensures that the specified users exist.
The PostgreSQL users will be identified using peer authentication. This authenticates the Unix user with the
same name only, and that without the need for a password.
This option will never delete existing users or remove permissions, especially not when the value of this
option is changed. This means that users created and permissions assigned once through this option or
otherwise have to be removed manually.
This option will never delete existing users or remove DB ownership of databases
once granted with `ensureDBOwnership = true;`. This means that this must be
cleaned up manually when changing after changing the config in here.
'';
example = literalExpression ''
[
{
name = "nextcloud";
ensurePermissions = {
"DATABASE nextcloud" = "ALL PRIVILEGES";
};
}
{
name = "superuser";
ensurePermissions = {
"ALL TABLES IN SCHEMA public" = "ALL PRIVILEGES";
};
ensureDBOwnership = true;
}
]
'';
@ -445,6 +428,19 @@ in
config = mkIf cfg.enable {
assertions = [
{
assertion = all
({ name, ensureDBOwnership, ... }: ensureDBOwnership -> builtins.elem name cfg.ensureDatabases)
cfg.ensureUsers;
message = ''
For each database user defined with `services.postgresql.ensureUsers` and
`ensureDBOwnership = true;`, a database with the same name must be defined
in `services.postgresql.ensureDatabases`.
'';
}
];
services.postgresql.settings =
{
hba_file = "${pkgs.writeText "pg_hba.conf" cfg.authentication}";
@ -557,11 +553,9 @@ in
concatMapStrings
(user:
let
userPermissions = concatStringsSep "\n"
(mapAttrsToList
(database: permission: ''$PSQL -tAc 'GRANT ${permission} ON ${database} TO "${user.name}"' '')
user.ensurePermissions
);
dbOwnershipStmt = optionalString
user.ensureDBOwnership
''$PSQL -tAc 'ALTER DATABASE "${user.name}" OWNER TO "${user.name}";' '';
filteredClauses = filterAttrs (name: value: value != null) user.ensureClauses;
@ -570,8 +564,9 @@ in
userClauses = ''$PSQL -tAc 'ALTER ROLE "${user.name}" ${concatStringsSep " " clauseSqlStatements}' '';
in ''
$PSQL -tAc "SELECT 1 FROM pg_roles WHERE rolname='${user.name}'" | grep -q 1 || $PSQL -tAc 'CREATE USER "${user.name}"'
${userPermissions}
${userClauses}
${dbOwnershipStmt}
''
)
cfg.ensureUsers

View file

@ -204,7 +204,7 @@ in
assertions = [
{
assertion = cfg.database.createLocally -> cfg.database.user == "zammad";
assertion = cfg.database.createLocally -> cfg.database.user == "zammad" && cfg.database.name == "zammad";
message = "services.zammad.database.user must be set to \"zammad\" if services.zammad.database.createLocally is set to true";
}
{
@ -231,7 +231,7 @@ in
ensureUsers = [
{
name = cfg.database.user;
ensurePermissions = { "DATABASE ${cfg.database.name}" = "ALL PRIVILEGES"; };
ensureDBOwnership = true;
}
];
};

View file

@ -121,7 +121,7 @@ in
ensureDatabases = [ "odoo" ];
ensureUsers = [{
name = "odoo";
ensurePermissions = { "DATABASE odoo" = "ALL PRIVILEGES"; };
ensureDBOwnership = true;
}];
};
});

View file

@ -168,7 +168,7 @@ in {
ensureUsers = [{
name = "listmonk";
ensurePermissions = { "DATABASE listmonk" = "ALL PRIVILEGES"; };
ensureDBOwnership = true;
}];
ensureDatabases = [ "listmonk" ];

View file

@ -179,14 +179,22 @@ in
};
};
assertions = [
{
assertion = localDB -> cfg.database.username == cfg.database.dbname;
message = ''
When setting up a DB and its owner user, the owner and the DB name must be
equal!
'';
}
];
services.postgresql = mkIf localDB {
enable = true;
ensureDatabases = [ cfg.database.dbname ];
ensureUsers = [ {
name = cfg.database.username;
ensurePermissions = {
"DATABASE ${cfg.database.username}" = "ALL PRIVILEGES";
};
ensureDBOwnership = true;
} ];
};

View file

@ -218,7 +218,7 @@ in
default = null;
example = "/run/keys/sympa-dbpassword";
description = lib.mdDoc ''
A file containing the password for {option}`services.sympa.database.user`.
A file containing the password for {option}`services.sympa.database.name`.
'';
};
@ -342,6 +342,7 @@ in
db_type = cfg.database.type;
db_name = cfg.database.name;
db_user = cfg.database.name;
}
// (optionalAttrs (cfg.database.host != null) {
db_host = cfg.database.host;
@ -355,9 +356,6 @@ in
// (optionalAttrs (cfg.database.port != null) {
db_port = cfg.database.port;
})
// (optionalAttrs (cfg.database.user != null) {
db_user = cfg.database.user;
})
// (optionalAttrs (cfg.mta.type == "postfix") {
sendmail_aliases = "${dataDir}/sympa_transport";
aliases_program = "${pkgs.postfix}/bin/postmap";
@ -393,7 +391,7 @@ in
users.groups.${group} = {};
assertions = [
{ assertion = cfg.database.createLocally -> cfg.database.user == user;
{ assertion = cfg.database.createLocally -> cfg.database.user == user && cfg.database.name == cfg.database.user;
message = "services.sympa.database.user must be set to ${user} if services.sympa.database.createLocally is set to true";
}
{ assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
@ -579,7 +577,7 @@ in
ensureDatabases = [ cfg.database.name ];
ensureUsers = [
{ name = cfg.database.user;
ensurePermissions = { "DATABASE ${cfg.database.name}" = "ALL PRIVILEGES"; };
ensureDBOwnership = true;
}
];
};

View file

@ -74,9 +74,9 @@ in
services.postgresql = lib.optionalAttrs cfg.createDatabase {
enable = true;
ensureDatabases = [ "matrix-sliding-sync" ];
ensureUsers = [ rec {
ensureUsers = [ {
name = "matrix-sliding-sync";
ensurePermissions."DATABASE \"${name}\"" = "ALL PRIVILEGES";
ensureDBOwnership = true;
} ];
};

View file

@ -135,9 +135,7 @@ in {
ensureDatabases = ["mautrix-facebook"];
ensureUsers = [{
name = "mautrix-facebook";
ensurePermissions = {
"DATABASE \"mautrix-facebook\"" = "ALL PRIVILEGES";
};
ensureDBOwnership = true;
}];
};

View file

@ -73,9 +73,7 @@ in
enable = true;
ensureUsers = [{
name = "atuin";
ensurePermissions = {
"DATABASE atuin" = "ALL PRIVILEGES";
};
ensureDBOwnership = true;
}];
ensureDatabases = [ "atuin" ];
};

View file

@ -357,6 +357,14 @@ in
assertion = cfg.database.createDatabase -> useSqlite || cfg.database.user == cfg.user;
message = "services.forgejo.database.user must match services.forgejo.user if the database is to be automatically provisioned";
}
{ assertion = cfg.database.createDatabase && usePostgresql -> cfg.database.user == cfg.database.name;
message = ''
When creating a database via NixOS, the db user and db name must be equal!
If you already have an existing DB+user and this assertion is new, you can safely set
`services.forgejo.createDatabase` to `false` because removal of `ensureUsers`
and `ensureDatabases` doesn't have any effect.
'';
}
];
services.forgejo.settings = {
@ -423,7 +431,7 @@ in
ensureUsers = [
{
name = cfg.database.user;
ensurePermissions = { "DATABASE ${cfg.database.name}" = "ALL PRIVILEGES"; };
ensureDBOwnership = true;
}
];
};

View file

@ -394,6 +394,14 @@ in
{ assertion = cfg.database.createDatabase -> useSqlite || cfg.database.user == cfg.user;
message = "services.gitea.database.user must match services.gitea.user if the database is to be automatically provisioned";
}
{ assertion = cfg.database.createDatabase && usePostgresql -> cfg.database.user == cfg.database.name;
message = ''
When creating a database via NixOS, the db user and db name must be equal!
If you already have an existing DB+user and this assertion is new, you can safely set
`services.gitea.createDatabase` to `false` because removal of `ensureUsers`
and `ensureDatabases` doesn't have any effect.
'';
}
];
services.gitea.settings = {
@ -461,7 +469,7 @@ in
ensureDatabases = [ cfg.database.name ];
ensureUsers = [
{ name = cfg.database.user;
ensurePermissions = { "DATABASE ${cfg.database.name}" = "ALL PRIVILEGES"; };
ensureDBOwnership = true;
}
];
};

View file

@ -267,7 +267,7 @@ in
{ assertion = cfg.database.passwordFile != null || cfg.database.socket != null;
message = "one of services.redmine.database.socket or services.redmine.database.passwordFile must be set";
}
{ assertion = cfg.database.createLocally -> cfg.database.user == cfg.user;
{ assertion = cfg.database.createLocally -> cfg.database.user == cfg.user && cfg.database.user == cfg.database.name;
message = "services.redmine.database.user must be set to ${cfg.user} if services.redmine.database.createLocally is set true";
}
{ assertion = cfg.database.createLocally -> cfg.database.socket != null;
@ -315,7 +315,7 @@ in
ensureDatabases = [ cfg.database.name ];
ensureUsers = [
{ name = cfg.database.user;
ensurePermissions = { "DATABASE ${cfg.database.name}" = "ALL PRIVILEGES"; };
ensureDBOwnership = true;
}
];
};

View file

@ -242,6 +242,15 @@ in
} cfg.nginx.virtualHost ];
};
assertions = [
{
assertion = srvCfg.user == srvCfg.postgresql.database;
message = ''
When creating a database via NixOS, the db user and db name must be equal!
'';
}
];
services.postgresql = mkIf cfg.postgresql.enable {
authentication = ''
local ${srvCfg.postgresql.database} ${srvCfg.user} trust
@ -249,7 +258,7 @@ in
ensureDatabases = [ srvCfg.postgresql.database ];
ensureUsers = map (name: {
inherit name;
ensurePermissions = { "DATABASE \"${srvCfg.postgresql.database}\"" = "ALL PRIVILEGES"; };
ensureDBOwnership = true;
}) [srvCfg.user];
};

View file

@ -203,7 +203,7 @@ in
{ assertion = !config.services.zabbixServer.enable;
message = "Please choose one of services.zabbixServer or services.zabbixProxy.";
}
{ assertion = cfg.database.createLocally -> cfg.database.user == user;
{ assertion = cfg.database.createLocally -> cfg.database.user == user && cfg.database.name == cfg.database.user;
message = "services.zabbixProxy.database.user must be set to ${user} if services.zabbixProxy.database.createLocally is set true";
}
{ assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
@ -252,7 +252,7 @@ in
ensureDatabases = [ cfg.database.name ];
ensureUsers = [
{ name = cfg.database.user;
ensurePermissions = { "DATABASE ${cfg.database.name}" = "ALL PRIVILEGES"; };
ensureDBOwnership = true;
}
];
};

View file

@ -191,7 +191,7 @@ in
config = mkIf cfg.enable {
assertions = [
{ assertion = cfg.database.createLocally -> cfg.database.user == user;
{ assertion = cfg.database.createLocally -> cfg.database.user == user && cfg.database.user == cfg.database.name;
message = "services.zabbixServer.database.user must be set to ${user} if services.zabbixServer.database.createLocally is set true";
}
{ assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
@ -240,7 +240,7 @@ in
ensureDatabases = [ cfg.database.name ];
ensureUsers = [
{ name = cfg.database.user;
ensurePermissions = { "DATABASE ${cfg.database.name}" = "ALL PRIVILEGES"; };
ensureDBOwnership = true;
}
];
};

View file

@ -55,7 +55,7 @@ in {
ensureDatabases = [ "hockeypuck" ];
ensureUsers = [{
name = "hockeypuck";
ensurePermissions."DATABASE hockeypuck" = "ALL PRIVILEGES";
ensureDBOwnership = true;
}];
};
```

View file

@ -149,8 +149,8 @@ in {
config = mkIf cfg.enable {
assertions = [
{ assertion = cfg.database.createLocally -> cfg.database.username == name;
message = "services.coder.database.username must be set to ${user} if services.coder.database.createLocally is set true";
{ assertion = cfg.database.createLocally -> cfg.database.username == name && cfg.database.database == cfg.database.username;
message = "services.coder.database.username must be set to ${name} if services.coder.database.createLocally is set true";
}
];
@ -193,10 +193,8 @@ in {
cfg.database.database
];
ensureUsers = [{
name = cfg.database.username;
ensurePermissions = {
"DATABASE \"${cfg.database.database}\"" = "ALL PRIVILEGES";
};
name = cfg.user;
ensureDBOwnership = true;
}
];
};

View file

@ -128,9 +128,7 @@ in
ensureUsers = [
{
name = "gotosocial";
ensurePermissions = {
"DATABASE gotosocial" = "ALL PRIVILEGES";
};
ensureDBOwnership = true;
}
];
};

View file

@ -112,12 +112,6 @@ let
services.postgresql = {
enable = true;
ensureDatabases = lib.singleton cfg.settings.db.dbname;
ensureUsers = lib.singleton {
name = cfg.settings.db.user;
ensurePermissions = {
"DATABASE ${cfg.settings.db.dbname}" = "ALL PRIVILEGES";
};
};
# This is only needed because the unix user invidious isn't the same as
# the database user. This tells postgres to map one to the other.
identMap = ''

View file

@ -146,7 +146,7 @@ in
ensureDatabases = [ cfg.settings.database.database ];
ensureUsers = [{
name = cfg.settings.database.user;
ensurePermissions."DATABASE ${cfg.settings.database.database}" = "ALL PRIVILEGES";
ensureDBOwnership = true;
}];
};

View file

@ -557,7 +557,7 @@ in {
config = lib.mkIf cfg.enable (lib.mkMerge [{
assertions = [
{
assertion = databaseActuallyCreateLocally -> (cfg.user == cfg.database.user);
assertion = databaseActuallyCreateLocally -> (cfg.user == cfg.database.user && cfg.database.user == cfg.database.name);
message = ''
For local automatic database provisioning (services.mastodon.database.createLocally == true) with peer
authentication (services.mastodon.database.host == "/run/postgresql") to work services.mastodon.user
@ -799,8 +799,8 @@ in {
enable = true;
ensureUsers = [
{
name = cfg.database.user;
ensurePermissions."DATABASE ${cfg.database.name}" = "ALL PRIVILEGES";
name = cfg.database.name;
ensureDBOwnership = true;
}
];
ensureDatabases = [ cfg.database.name ];

View file

@ -454,7 +454,7 @@ in
{ assertion = cfg.database.createLocally -> (cfg.database.type == "mysql" || cfg.database.type == "postgres");
message = "services.mediawiki.createLocally is currently only supported for database type 'mysql' and 'postgres'";
}
{ assertion = cfg.database.createLocally -> cfg.database.user == user;
{ assertion = cfg.database.createLocally -> cfg.database.user == user && cfg.database.name == cfg.database.user;
message = "services.mediawiki.database.user must be set to ${user} if services.mediawiki.database.createLocally is set true";
}
{ assertion = cfg.database.createLocally -> cfg.database.socket != null;
@ -486,7 +486,7 @@ in
ensureDatabases = [ cfg.database.name ];
ensureUsers = [{
name = cfg.database.user;
ensurePermissions = { "DATABASE \"${cfg.database.name}\"" = "ALL PRIVILEGES"; };
ensureDBOwnership = true;
}];
};

View file

@ -6,13 +6,10 @@ let
defaultAddress = "localhost:8080";
dbUser = "miniflux";
dbName = "miniflux";
pgbin = "${config.services.postgresql.package}/bin";
preStart = pkgs.writeScript "miniflux-pre-start" ''
#!${pkgs.runtimeShell}
${pgbin}/psql "${dbName}" -c "CREATE EXTENSION IF NOT EXISTS hstore"
${pgbin}/psql "miniflux" -c "CREATE EXTENSION IF NOT EXISTS hstore"
'';
in
@ -62,7 +59,7 @@ in
services.miniflux.config = {
LISTEN_ADDR = mkDefault defaultAddress;
DATABASE_URL = "user=${dbUser} host=/run/postgresql dbname=${dbName}";
DATABASE_URL = "user=miniflux host=/run/postgresql dbname=miniflux";
RUN_MIGRATIONS = "1";
CREATE_ADMIN = "1";
};
@ -70,12 +67,10 @@ in
services.postgresql = {
enable = true;
ensureUsers = [ {
name = dbUser;
ensurePermissions = {
"DATABASE ${dbName}" = "ALL PRIVILEGES";
};
name = "miniflux";
ensureDBOwnership = true;
} ];
ensureDatabases = [ dbName ];
ensureDatabases = [ "miniflux" ];
};
systemd.services.miniflux-dbsetup = {
@ -97,7 +92,7 @@ in
serviceConfig = {
ExecStart = "${cfg.package}/bin/miniflux";
User = dbUser;
User = "miniflux";
DynamicUser = true;
RuntimeDirectory = "miniflux";
RuntimeDirectoryMode = "0700";

View file

@ -212,6 +212,12 @@ in
assertion = cfg.nginx.enable -> (cfg.settings.":mobilizon"."Mobilizon.Web.Endpoint".http.ip == settingsFormat.lib.mkTuple [ 0 0 0 0 0 0 0 1 ]);
message = "Setting the IP mobilizon listens on is only possible when the nginx config is not used, as it is hardcoded there.";
}
{
assertion = isLocalPostgres -> repoSettings.database == repoSettings.username;
message = ''
When creating a database via NixOS, the db user and db name must be equal!
'';
}
];
services.mobilizon.settings = {
@ -372,9 +378,7 @@ in
ensureUsers = [
{
name = dbUser;
ensurePermissions = {
"DATABASE \"${repoSettings.database}\"" = "ALL PRIVILEGES";
};
ensureDBOwnership = true;
}
];
extraPlugins = with postgresql.pkgs; [ postgis ];

View file

@ -194,7 +194,7 @@ in
config = mkIf cfg.enable {
assertions = [
{ assertion = cfg.database.createLocally -> cfg.database.user == user;
{ assertion = cfg.database.createLocally -> cfg.database.user == user && cfg.database.user == cfg.database.name;
message = "services.moodle.database.user must be set to ${user} if services.moodle.database.createLocally is set true";
}
{ assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
@ -220,7 +220,7 @@ in
ensureDatabases = [ cfg.database.name ];
ensureUsers = [
{ name = cfg.database.user;
ensurePermissions = { "DATABASE ${cfg.database.name}" = "ALL PRIVILEGES"; };
ensureDBOwnership = true;
}
];
};

View file

@ -257,9 +257,7 @@ in {
ensureUsers = [
{
name = "netbox";
ensurePermissions = {
"DATABASE netbox" = "ALL PRIVILEGES";
};
ensureDBOwnership = true;
}
];
};

View file

@ -1042,7 +1042,7 @@ in {
ensureDatabases = [ cfg.config.dbname ];
ensureUsers = [{
name = cfg.config.dbuser;
ensurePermissions = { "DATABASE ${cfg.config.dbname}" = "ALL PRIVILEGES"; };
ensureDBOwnership = true;
}];
};

View file

@ -198,7 +198,7 @@ in
ensureDatabases = [ "onlyoffice" ];
ensureUsers = [{
name = "onlyoffice";
ensurePermissions = { "DATABASE \"onlyoffice\"" = "ALL PRIVILEGES"; };
ensureDBOwnership = true;
}];
};
};

View file

@ -581,7 +581,7 @@ in
enable = true;
ensureUsers = [{
name = "outline";
ensurePermissions."DATABASE outline" = "ALL PRIVILEGES";
ensureDBOwnership = true;
}];
ensureDatabases = [ "outline" ];
};

View file

@ -186,9 +186,7 @@ in {
ensureUsers = [
{
name = "peering-manager";
ensurePermissions = {
"DATABASE \"peering-manager\"" = "ALL PRIVILEGES";
};
ensureDBOwnership = true;
}
];
};

View file

@ -271,7 +271,6 @@ in {
ensureDatabases = [ cfg.database.name ];
ensureUsers = [{
name = user;
ensurePermissions = { };
}];
};

View file

@ -529,6 +529,15 @@ let
assertion = cfg.database.password != null -> cfg.database.passwordFile == null;
message = "Cannot set both password and passwordFile";
}
{
assertion = cfg.database.createLocally -> cfg.database.name == cfg.user && cfg.database.user == cfg.user;
message = ''
When creating a database via NixOS, the db user and db name must be equal!
If you already have an existing DB+user and this assertion is new, you can safely set
`services.tt-rss.database.createLocally` to `false` because removal of `ensureUsers`
and `ensureDatabases` doesn't have any effect.
'';
}
];
services.phpfpm.pools = mkIf (cfg.pool == "${poolName}") {
@ -632,8 +641,8 @@ let
enable = mkDefault true;
ensureDatabases = [ cfg.database.name ];
ensureUsers = [
{ name = cfg.user;
ensurePermissions = { "DATABASE ${cfg.database.name}" = "ALL PRIVILEGES"; };
{ name = cfg.database.user;
ensureDBOwnership = true;
}
];
};

View file

@ -93,7 +93,7 @@ in with lib; {
ensureDatabases = [ "hydron" ];
ensureUsers = [
{ name = "hydron";
ensurePermissions = { "DATABASE hydron" = "ALL PRIVILEGES"; };
ensureDBOwnership = true;
}
];
};

View file

@ -49,7 +49,7 @@ import ./make-test-python.nix ({ lib, ... }: {
ensureUsers = [
{
name = "dex";
ensurePermissions = { "DATABASE dex" = "ALL PRIVILEGES"; };
ensureDBOwnership = true;
}
];
};

View file

@ -39,7 +39,7 @@ with import ../lib/testing-python.nix { inherit system; };
ensureDatabases = [ "ferretdb" ];
ensureUsers = [{
name = "ferretdb";
ensurePermissions."DATABASE ferretdb" = "ALL PRIVILEGES";
ensureDBOwnership = true;
}];
};

View file

@ -22,9 +22,7 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
ensureUsers = [
{
name = "freshrss";
ensurePermissions = {
"DATABASE freshrss" = "ALL PRIVILEGES";
};
ensureDBOwnership = true;
}
];
initialScript = pkgs.writeText "postgresql-password" ''

View file

@ -55,7 +55,7 @@ let
ensureDatabases = [ "grafana" ];
ensureUsers = [{
name = "grafana";
ensurePermissions."DATABASE grafana" = "ALL PRIVILEGES";
ensureDBOwnership = true;
}];
};
systemd.services.grafana.after = [ "postgresql.service" ];

View file

@ -35,7 +35,7 @@ in {
ensureDatabases = [ "hockeypuck" ];
ensureUsers = [{
name = "hockeypuck";
ensurePermissions."DATABASE hockeypuck" = "ALL PRIVILEGES";
ensureDBOwnership = true;
}];
};
};

View file

@ -9,13 +9,11 @@ in {
nodes.hass = { pkgs, ... }: {
services.postgresql = {
enable = true;
# FIXME: hack for https://github.com/NixOS/nixpkgs/issues/216989
# Should be replaced with ensureUsers again when a solution for that is found
initialScript = pkgs.writeText "hass-setup-db.sql" ''
CREATE ROLE hass WITH LOGIN;
CREATE DATABASE hass WITH OWNER hass;
'';
ensureDatabases = [ "hass" ];
ensureUsers = [{
name = "hass";
ensureDBOwnership = true;
}];
};
services.home-assistant = {

View file

@ -17,7 +17,7 @@ import ./make-test-python.nix ({ lib, ... }: {
ensureDatabases = [ "paperless" ];
ensureUsers = [
{ name = config.services.paperless.user;
ensurePermissions = { "DATABASE \"paperless\"" = "ALL PRIVILEGES"; };
ensureDBOwnership = true;
}
];
};

View file

@ -19,14 +19,6 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
authentication = ''
host all all localhost trust
'';
ensureUsers = [
{
name = "postgres";
ensurePermissions = {
"DATABASE \"postgres\"" = "ALL PRIVILEGES";
};
}
];
};
services.pgadmin = {

View file

@ -24,13 +24,11 @@ in
services = {
postgresql = {
enable = true;
ensureDatabases = [ "testdb" ];
ensureDatabases = [ "test" ];
ensureUsers = [
{
name = "testuser";
ensurePermissions = {
"DATABASE testdb" = "ALL PRIVILEGES";
};
name = "test";
ensureDBOwnership = true;
}];
authentication = ''
local testdb testuser scram-sha-256
@ -40,7 +38,7 @@ in
pgbouncer = {
enable = true;
listenAddress = "localhost";
databases = { testdb = "host=/run/postgresql/ port=5432 auth_user=testuser dbname=testdb"; };
databases = { test = "host=/run/postgresql/ port=5432 auth_user=testuser dbname=test"; };
authType = "scram-sha-256";
authFile = testAuthFile;
};
@ -55,7 +53,7 @@ in
# Test if we can make a query through PgBouncer
one.wait_until_succeeds(
"psql 'postgres://testuser:testpass@localhost:6432/testdb' -c 'SELECT 1;'"
"psql 'postgres://testuser:testpass@localhost:6432/test' -c 'SELECT 1;'"
)
'';
})

View file

@ -87,9 +87,7 @@ let
ensureUsers = [
{
name = "powerdnsadmin";
ensurePermissions = {
"DATABASE powerdnsadmin" = "ALL PRIVILEGES";
};
ensureDBOwnership = true;
}
];
};

View file

@ -156,7 +156,7 @@ in
ensureDatabases = [ "sftpgo" ];
ensureUsers = [{
name = "sftpgo";
ensurePermissions."DATABASE sftpgo" = "ALL PRIVILEGES";
ensureDBOwnership = true;
}];
};

View file

@ -5,6 +5,29 @@ import ./make-test-python.nix ({ lib, ... }: {
nodes.machine = { pkgs, ... }: {
services.tandoor-recipes = {
enable = true;
extraConfig = {
DB_ENGINE = "django.db.backends.postgresql";
POSTGRES_HOST = "/run/postgresql";
POSTGRES_USER = "tandoor_recipes";
POSTGRES_DB = "tandoor_recipes";
};
};
services.postgresql = {
enable = true;
ensureDatabases = [ "tandoor_recipes" ];
ensureUsers = [
{
name = "tandoor_recipes";
ensureDBOwnership = true;
}
];
};
systemd.services = {
tandoor-recipes = {
after = [ "postgresql.service" ];
};
};
};

View file

@ -33,7 +33,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
ensureDatabases = [ "vikunja-api" ];
ensureUsers = [
{ name = "vikunja-api";
ensurePermissions = { "DATABASE \"vikunja-api\"" = "ALL PRIVILEGES"; };
ensureDBOwnership = true;
}
];
};

View file

@ -10,14 +10,15 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
enable = true;
settings.db.host = "/run/postgresql";
settings.db.user = "wiki-js";
settings.db.db = "wiki-js";
settings.logLevel = "debug";
};
services.postgresql = {
enable = true;
ensureDatabases = [ "wiki" ];
ensureDatabases = [ "wiki-js" ];
ensureUsers = [
{ name = "wiki-js";
ensurePermissions."DATABASE wiki" = "ALL PRIVILEGES";
ensureDBOwnership = true;
}
];
};