Skip to content

Commit e878711

Browse files
utkarash2991utkarash2991
committed
Merge develop into pg-17-10-update (keep 17.11.0.001/15.19.0.001, take orioledb 17.9.0.021)
2 parents 91b5eeb + 87ea6ea commit e878711

82 files changed

Lines changed: 1567 additions & 96728 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.ansible-lint-ignore‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
# This file contains ignores rule violations for ansible-lint
2+
ansible/files/envoy_config/cds.yaml yaml[empty-lines]
3+
ansible/files/envoy_config/envoy.yaml yaml[empty-lines]
4+
ansible/files/envoy_config/lds.supabase.yaml yaml[empty-lines]
5+
ansible/files/envoy_config/lds.yaml yaml[empty-lines]
6+
ansible/playbook.yml command-instead-of-module
7+
ansible/playbook.yml command-instead-of-shell
8+
ansible/playbook.yml fqcn[action-core]
9+
ansible/playbook.yml name[casing]
10+
ansible/playbook.yml name[missing]
11+
ansible/playbook.yml name[play]
12+
ansible/playbook.yml no-changed-when
13+
ansible/playbook.yml risky-file-permissions
14+
ansible/tasks/finalize-ami.yml fqcn[action-core]
15+
ansible/tasks/finalize-ami.yml name[casing]
16+
ansible/tasks/finalize-ami.yml risky-file-permissions
17+
ansible/tasks/fix-ipv6-ndisc.yml name[casing]
18+
ansible/tasks/internal/admin-api.yml fqcn[action-core]
19+
ansible/tasks/internal/admin-api.yml fqcn[action]
20+
ansible/tasks/internal/admin-api.yml name[casing]
21+
ansible/tasks/internal/admin-api.yml no-changed-when
22+
ansible/tasks/internal/admin-api.yml risky-file-permissions
23+
ansible/tasks/internal/admin-mgr.yml fqcn[action-core]
24+
ansible/tasks/internal/admin-mgr.yml name[casing]
25+
ansible/tasks/internal/admin-mgr.yml risky-file-permissions
26+
ansible/tasks/internal/collect-pg-binaries.yml fqcn[action-core]
27+
ansible/tasks/internal/collect-pg-binaries.yml fqcn[action]
28+
ansible/tasks/internal/collect-pg-binaries.yml risky-file-permissions
29+
ansible/tasks/internal/install-aws-cli.yml name[casing]
30+
ansible/tasks/internal/install-aws-cli.yml no-changed-when
31+
ansible/tasks/internal/install-aws-cli.yml risky-file-permissions
32+
ansible/tasks/internal/install-salt.yml fqcn[action-core]
33+
ansible/tasks/internal/install-salt.yml jinja[spacing]
34+
ansible/tasks/internal/install-salt.yml name[casing]
35+
ansible/tasks/internal/optimizations.yml fqcn[action-core]
36+
ansible/tasks/internal/optimizations.yml name[casing]
37+
ansible/tasks/internal/pg_egress_collect.yml fqcn[action-core]
38+
ansible/tasks/internal/pg_egress_collect.yml name[casing]
39+
ansible/tasks/internal/pg_egress_collect.yml risky-file-permissions
40+
ansible/tasks/internal/pg_egress_collect.yml yaml[empty-lines]
41+
ansible/tasks/internal/postgres-exporter.yml fqcn[action-core]
42+
ansible/tasks/internal/postgres-exporter.yml fqcn[action]
43+
ansible/tasks/internal/postgres-exporter.yml name[casing]
44+
ansible/tasks/internal/postgres-exporter.yml risky-file-permissions
45+
ansible/tasks/internal/postgresql-prestart.yml fqcn[action-core]
46+
ansible/tasks/internal/postgresql-prestart.yml name[casing]
47+
ansible/tasks/internal/setup-ansible-pull.yml fqcn[action-core]
48+
ansible/tasks/internal/setup-ansible-pull.yml name[casing]
49+
ansible/tasks/internal/setup-ansible-pull.yml no-changed-when
50+
ansible/tasks/internal/setup-ansible-pull.yml risky-file-permissions
51+
ansible/tasks/internal/setup-nftables.yml fqcn[action-core]
52+
ansible/tasks/internal/setup-nftables.yml name[casing]
53+
ansible/tasks/internal/setup-nftables.yml no-changed-when
54+
ansible/tasks/internal/setup-nftables.yml risky-file-permissions
55+
ansible/tasks/internal/supabase-admin-agent.yml fqcn[action-core]
56+
ansible/tasks/internal/supabase-admin-agent.yml name[casing]
57+
ansible/tasks/internal/supabase-admin-agent.yml risky-file-permissions
58+
ansible/tasks/setup-fail2ban.yml name[casing]
59+
ansible/tasks/setup-fail2ban.yml risky-file-permissions
60+
ansible/tasks/setup-gotrue.yml name[casing]
61+
ansible/tasks/setup-gotrue.yml risky-file-permissions
62+
ansible/tasks/setup-kong.yml fqcn[action-core]
63+
ansible/tasks/setup-kong.yml no-changed-when
64+
ansible/tasks/setup-kong.yml risky-file-permissions
65+
ansible/tasks/setup-kvm-timesync.yml name[casing]
66+
ansible/tasks/setup-kvm-timesync.yml risky-file-permissions
67+
ansible/tasks/setup-migrations.yml name[casing]
68+
ansible/tasks/setup-migrations.yml no-changed-when
69+
ansible/tasks/setup-migrations.yml risky-file-permissions
70+
ansible/tasks/setup-pgbouncer.yml name[casing]
71+
ansible/tasks/setup-pgbouncer.yml no-changed-when
72+
ansible/tasks/setup-pgbouncer.yml risky-file-permissions
73+
ansible/tasks/setup-postgres.yml fqcn[action-core]
74+
ansible/tasks/setup-postgres.yml name[casing]
75+
ansible/tasks/setup-postgres.yml no-changed-when
76+
ansible/tasks/setup-postgres.yml risky-file-permissions
77+
ansible/tasks/setup-postgres.yml yaml[octal-values]
78+
ansible/tasks/setup-postgrest.yml jinja[spacing]
79+
ansible/tasks/setup-postgrest.yml name[casing]
80+
ansible/tasks/setup-postgrest.yml no-changed-when
81+
ansible/tasks/setup-postgrest.yml risky-file-permissions
82+
ansible/tasks/setup-supabase-internal.yml fqcn[action-core]
83+
ansible/tasks/setup-supabase-internal.yml name[casing]
84+
ansible/tasks/setup-supabase-internal.yml no-changed-when
85+
ansible/tasks/setup-supabase-internal.yml risky-file-permissions
86+
ansible/tasks/setup-supautils.yml name[casing]
87+
ansible/tasks/setup-supautils.yml risky-file-permissions
88+
ansible/tasks/setup-system.yml name[casing]
89+
ansible/tasks/setup-system.yml risky-file-permissions
90+
ansible/tasks/setup-tmux.yml name[casing]
91+
ansible/tasks/setup-wal-g.yml name[casing]
92+
ansible/tasks/setup-wal-g.yml no-changed-when
93+
ansible/tasks/stage2-setup-postgres.yml fqcn[action-core]
94+
ansible/tasks/stage2-setup-postgres.yml name[casing]
95+
ansible/tasks/stage2-setup-postgres.yml no-changed-when
96+
ansible/tasks/stage2-setup-postgres.yml risky-file-permissions
97+
ansible/tasks/stage2-setup-postgres.yml risky-shell-pipe
98+
ansible/tasks/stage2-setup-postgres.yml yaml[commas]
99+
ansible/tasks/test-image.yml no-changed-when
100+
ansible/tasks/test-image.yml risky-file-permissions

‎.github/workflows/test.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,33 +39,41 @@ jobs:
3939
steps:
4040
- name: Checkout Repo
4141
uses: supabase/postgres/.github/actions/shared-checkout@HEAD
42+
4243
- uses: ./.github/actions/nix-install-ephemeral
44+
4345
- name: Set PostgreSQL version environment variable
4446
run: echo "POSTGRES_MAJOR_VERSION=${{ matrix.postgres_version }}" >> $GITHUB_ENV
47+
4548
- name: Strip quotes from pg major and set env var
4649
run: |
4750
stripped_version=$(echo "${{ matrix.postgres_version }}" | sed 's/^"\(.*\)"$/\1/')
4851
echo "PGMAJOR=$stripped_version" >> $GITHUB_ENV
52+
4953
- name: Generate common-nix.vars.pkr.hcl
5054
run: |
5155
PG_VERSION=$(nix run nixpkgs#yq-go -- '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)
5256
PG_VERSION=$(echo $PG_VERSION | tr -d '"') # Remove any surrounding quotes
5357
echo 'postgres-version = "'$PG_VERSION'"' > common-nix.vars.pkr.hcl
5458
echo "" >> common-nix.vars.pkr.hcl
59+
5560
- id: settings
5661
run: sed -r 's/(\s|\")+//g' common-nix.vars.pkr.hcl >> $GITHUB_OUTPUT
62+
5763
- name: Generate args
5864
id: args
5965
run: |
6066
ARGS=$(nix run nixpkgs#yq-go -- 'to_entries | map(select(.value|type == "!!str")) | map(.key + "=" + .value) | join("\n")' ansible/vars.yml)
6167
echo "result<<EOF" >> $GITHUB_OUTPUT
6268
echo "$ARGS" >> $GITHUB_OUTPUT
6369
echo "EOF" >> $GITHUB_OUTPUT
70+
6471
- name: Resolve git sha
6572
id: resolve-git-sha
6673
uses: ./.github/actions/resolve-git-sha
6774
with:
6875
flake_input: ${{ vars.GIT_SHA_FROM_FLAKE_INPUT }}
76+
6977
- name: verify schema.sql is committed
7078
run: |
7179
nix run github:supabase/postgres/${{ steps.resolve-git-sha.outputs.sha }}#dbmate-tool -- --version ${{ env.PGMAJOR }} --flake-url github:supabase/postgres/${{ steps.resolve-git-sha.outputs.sha }}

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
!.env
33
!.gitignore
44
!.gitkeep
5+
!/.ansible-lint-ignore
56
!/.claude/
67
!/.coderabbit.yaml
78
!/.envrc.recommended

‎amazon-amd64-nix.pkr.hcl‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -170,11 +170,6 @@ source "amazon-ebssurrogate" "source" {
170170
build {
171171
sources = ["source.amazon-ebssurrogate.source"]
172172

173-
provisioner "file" {
174-
source = "ebssurrogate/files/sources.cfg"
175-
destination = "/tmp/sources.list"
176-
}
177-
178173
provisioner "file" {
179174
source = "ebssurrogate/files/ebsnvme-id"
180175
destination = "/tmp/ebsnvme-id"

‎amazon-arm64-nix.pkr.hcl‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -170,11 +170,6 @@ source "amazon-ebssurrogate" "source" {
170170
build {
171171
sources = ["source.amazon-ebssurrogate.source"]
172172

173-
provisioner "file" {
174-
source = "ebssurrogate/files/sources-arm64.cfg"
175-
destination = "/tmp/sources.list"
176-
}
177-
178173
provisioner "file" {
179174
source = "ebssurrogate/files/ebsnvme-id"
180175
destination = "/tmp/ebsnvme-id"

‎ansible/ansible-lint.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
use_default_rules: true
2+
rulesdir:
3+
- lint-rules

‎ansible/files/postgres_exporter.service.j2‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ StartLimitBurst=0
66

77
[Service]
88
Type=simple
9-
ExecStart=/opt/postgres_exporter/postgres_exporter --disable-settings-metrics --extend.query-path="/opt/postgres_exporter/queries.yml" --disable-default-metrics --no-collector.locks --no-collector.replication --no-collector.replication_slot --no-collector.stat_bgwriter --no-collector.stat_database --no-collector.stat_user_tables --no-collector.statio_user_tables --no-collector.wal {% if qemu %}--no-collector.database {% endif %}
9+
ExecStart=/opt/postgres_exporter/postgres_exporter --disable-settings-metrics --extend.query-path="/opt/postgres_exporter/queries.yml" --disable-default-metrics --no-collector.locks --no-collector.replication --no-collector.replication_slot --no-collector.stat_bgwriter --no-collector.stat_database --no-collector.stat_user_tables --no-collector.statio_user_tables --no-collector.wal --collector.database_wraparound {% if qemu %}--no-collector.database {% endif %}
1010

1111
User=postgres
1212
Group=postgres

‎ansible/lint-rules/identity_ids.py‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
from ansiblelint.file_utils import Lintable
2+
from ansiblelint.rules import AnsibleLintRule
3+
from ansiblelint.utils import Task
4+
5+
6+
class ExplicitIdentityIDRule(AnsibleLintRule):
7+
id = "explicit-identity-id"
8+
shortdesc = "Users and groups must specify numeric IDs"
9+
description = "ansible.builtin.user must specify uid and ansible.builtin.group must specify gid."
10+
severity = "HIGH"
11+
tags = ["idempotency"]
12+
version_changed = "1.0.0"
13+
14+
def matchtask(
15+
self,
16+
task: Task,
17+
file: Lintable | None = None,
18+
) -> bool | str:
19+
action = task["action"]
20+
module = action["__ansible_module__"].rsplit(".", 1)[-1]
21+
22+
if action.get("state", "present") == "absent":
23+
return False
24+
25+
if module == "user" and "uid" not in action:
26+
return "ansible.builtin.user must specify uid"
27+
28+
if module == "group" and "gid" not in action:
29+
return "ansible.builtin.group must specify gid"
30+
31+
return False

‎ansible/playbook.yml‎

Lines changed: 2 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -141,25 +141,12 @@
141141
when: not stage2
142142
import_tasks: tasks/setup-fail2ban.yml
143143

144-
# Install EC2 instance connect
145-
# Only for AWS images
146-
- name: install EC2 instance connect
147-
when: not qemu
148-
become: yes
149-
apt:
150-
pkg:
151-
- ec2-instance-connect
152-
tags:
153-
- aws-only
154-
155144
# Install this at the end to prevent it from kicking in during the apt process, causing conflicts
156145
- name: Install security tools
157146
become: yes
158147
apt:
159148
pkg:
160149
- unattended-upgrades
161-
update_cache: yes
162-
cache_valid_time: 3600
163150

164151
- name: Run migrations
165152
when: stage2
@@ -196,10 +183,10 @@
196183
systemctl stop fail2ban.service
197184
198185
- name: Run supascan baseline validation
199-
when: stage2 and not qemu and ansible_architecture != "x86_64"
186+
when: stage2 and not qemu
200187
become: yes
201188
shell: |
202-
/bin/bash /tmp/ansible-playbook/ansible/files/supascan_ami.sh /tmp/ansible-playbook/audit-specs/baselines/ami-build
189+
/bin/bash /tmp/ansible-playbook/ansible/files/supascan_ami.sh /tmp/ansible-playbook/audit-specs/baselines/ami-build-{{ platform }}
203190
204191
- name: Remove supascan after validation
205192
when: stage2

‎ansible/tasks/internal/admin-api.yml‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,15 @@
1+
- name: adminapi - system group
2+
ansible.builtin.group:
3+
name: adminapi
4+
gid: 1011
5+
state: present
6+
17
- name: adminapi - system user
2-
user:
8+
ansible.builtin.user:
39
name: adminapi
4-
groups: root,admin,envoy,gotrue,kong,pgbouncer,postgres,postgrest,systemd-journal,vector,wal-g
5-
append: yes
10+
uid: 1006
11+
group: adminapi
12+
groups: admin,envoy,gotrue,kong,pgbouncer,postgres,postgrest,root,systemd-journal,vector,wal-g
613

714
- name: Move shell scripts to /root dir
815
copy:

0 commit comments

Comments
 (0)