Repository navigation
Converge owned PostgreSQL databases with their role and password (S-006-5, 6, 7, 12, 13) #122
Description
Builds part of spec S-006, docs/specs/006-standalone-postgresql.md (feature issue #81): the acceptance criteria below. Each needs a test that names its id (test_s006_<k>_..., or a proves: S-006-5 comment line).
This is the services converge for an owned database: the role, its password from passwordRef, backups, and data copy.
- S-006-5: After
services.ymlconverges the service of S-006-1,pg_rolesholdsbillingwithrolcanloginand aSCRAM-SHA-256password, and databasebillingis owned bybilling - S-006-6: The password value appears in none of the rendered inventory, the playbook output, the command's answer, or any receipt, and the answer names the reference, the key, and the value's SHA-256
- S-006-7: A
passwordRefwhose file or key is missing stops the services converge withPRECONDITIONnaming the expected path and key, and no playbook runs - S-006-12: For the project in
config/examples,cloudfall-engine inventory renderwrites a byte-identical inventory before and after the change, and the renderedcloudfall.conf,nftables.conf, backup script, and restore-check script are identical - S-006-13: For the service of S-006-1, the backup script writes
billing-<timestamp>.dump, the restore drill restores it and passes, andcloudfall data copy <service> --database billing --source-url-file <file> --yesrestores as rolebillingand writes a receipt withspec.ownerofbilling
Depends on #121
Activity
shipmill-romamo commentedon Oct 27, 2026
Triage: implement, for the next release candidate.
The plan: build the criteria listed in the body, as
docs/specs/006-standalone-postgresql.md(S-006, approved in #101) says, each with a test that names its id. A departure from a criterion goes back as a question, never a quiet change. Build issues start in order: this one starts once every issue on itsDepends onlines has closed. I'll link the PR here.Validate PostgreSQL databases owned by a declared role
Validate PostgreSQL databases owned by a declared role (#121) (#131)
shipmill-romamo commentedon Oct 27, 2026
PR #139 makes
services.ymlcreate the owner login role, set its SCRAM password frompasswordRefon every converge, and make it own the database. Every path that runs it reads--secrets-dir, stages the value in a 0600 file outside the project for the run only, and keeps it out of inventory, output, answers and receipts; a missing file or key isPRECONDITIONbefore any playbook. Example renders are pinned byte for byte (S-006-12). I asked it to also name the reference, key and SHA-256 in the operator's answer before it lands.Trade-off:
pg_roles, a real dump, the drill, andpg_restore --roleon a live PostgreSQL host (S-006-5, S-006-13) aren't exercised; tests cover the task logic and thedata copyreceipt'sspec.owner.Name owner password hashes in the operator's answer and receipt
Run services.yml as before on an inventory with no owned database
shipmill-romamo commentedon Oct 27, 2026
Released in v0.8.0rc7 (pre-release). uv tool install --prerelease allow cloudfall==0.8.0rc7
A plain install gets it with the next stable release.
If you filed this: react 👍 on this comment once it works for you, or reply if it doesn't.