Repository navigation
Validate PostgreSQL databases owned by a declared role (S-006-1..4, S-006-11) #121
Description
Builds part of spec S-006, docs/specs/006-standalone-postgresql.md (feature issue #81): the acceptance criteria below. Each needs a test that names its id (test_s006_<k>_..., or a proves: S-006-1 comment line).
This is the schema and config validate side: databases with an owner, and the remoteAccess rules.
- S-006-1: A project with one
Server, its server type, and one PostgreSQLServicewhose only database declaresowner: billingand apasswordRef, and noApplicationorComponent, passescloudfall config validatewith exit 0 - S-006-2: A database entry with both
applicationandownerfailscloudfall config validatewithCONFIG_INVALIDnamingspec.postgresql.databases[0], and an entry with neither fails the same way - S-006-3:
ownerwithoutpasswordReffailscloudfall config validatewithCONFIG_INVALID, and so doespasswordRefnext toapplication - S-006-4: An
ownerofpostgres, ofalloy, or equal to the Linux user of anApplicationwith a database on the same service fails withCONFIG_INVALIDcodeservice_database_owner_reserved - S-006-11:
remoteAccessfailscloudfall config validatewithCONFIG_INVALIDand codeservice_remote_access_unusedwhen no database names anowner,service_remote_access_unfirewalledwhen the server type declares nofirewall,service_remote_access_port_openwhen itsallowedInboundopens the service port, andservice_remote_access_openfor a source of0.0.0.0/0or::/0
Activity
shipmill-romamo commentedon Oct 27, 2026
Triage: implement, for the next release candidate.
The plan: build the criteria listed in the body, as
docs/specs/006-standalone-postgresql.md(S-006, approved in #101) says, each with a test that names its id. A departure from a criterion goes back as a question, never a quiet change. Build issues start in order: this one starts once every issue on itsDepends onlines has closed. I'll link the PR here.shipmill-romamo commentedon Oct 27, 2026
The build is in #131: a PostgreSQL database may name an
ownerand apasswordRefinstead of anapplication, andremoteAccessis validated as S-006-11 says. The example project's rendered inventory is byte-identical. Until #122 lands, the PostgreSQL role refuses an owned database before any task runs. This issue closes when #131 merges.Validate PostgreSQL databases owned by a declared role
shipmill-romamo commentedon Oct 27, 2026
Released in v0.8.0rc6 (pre-release). uv tool install --prerelease allow cloudfall==0.8.0rc6
A plain install gets it with the next stable release.
If you filed this: react 👍 on this comment once it works for you, or reply if it doesn't.