Repository navigation
Open a PostgreSQL service to declared sources over TLS (S-006-8, 9, 10) #123
Description
Builds part of spec S-006, docs/specs/006-standalone-postgresql.md (feature issue #81): the acceptance criteria below. Each needs a test that names its id (test_s006_<k>_..., or a proves: S-006-8 comment line).
This is remoteAccess: TLS listening, pg_hba.conf, and the nftables rule for the service port.
- S-006-8: With
remoteAccessoflistenAddress: 10.0.0.2andallowedSources: [10.0.0.0/24], the convergedcloudfall.confreadslisten_addresses = '127.0.0.1,10.0.0.2'andssl = on, the Cloudfall block inpg_hba.confholds exactlyhostssl billing billing 10.0.0.0/24 scram-sha-256, and the rendered nftables ruleset holdsip saddr 10.0.0.0/24 tcp dport 5432 acceptand no unrestricted rule for port 5432 - S-006-9: On a proving pair of hosts,
psqlfrom an address inallowedSourcesasbillingwithsslmode=requireconnects, from an address outside it gets no connection, and from an allowed address withsslmode=disableis refused withno pg_hba.conf entry - S-006-10: Removing
remoteAccessand converging baseline and services leaveslisten_addresses = '127.0.0.1', no Cloudfall block inpg_hba.conf, and no rule for the service port in nftables
S-006-9 needs a live proving run on two hosts; the PR may prove the rest with rendered output and name S-006-9 as left for that run.
Depends on #122
Activity
shipmill-romamo commentedon Oct 27, 2026
Triage: implement, for the next release candidate.
The plan: build the criteria listed in the body, as
docs/specs/006-standalone-postgresql.md(S-006, approved in #101) says, each with a test that names its id. A departure from a criterion goes back as a question, never a quiet change. Build issues start in order: this one starts once every issue on itsDepends onlines has closed. I'll link the PR here.shipmill-romamo commentedon Oct 27, 2026
PR #141 implements
remoteAccess: TLS listening on loopback pluslistenAddress, onehostssl ... scram-sha-256line per owned database and source between Cloudfall markers inpg_hba.conf(checked withpg_hba_file_rulesbefore a reload, removed and the run failed if PostgreSQL rejects it), and one source-restricted nftables rule per CIDR. RemovingremoteAccesscloses all three again (S-006-10). Proves S-006-8 and S-006-10.Left open: S-006-9 needs the live two-host proving run, so spec 006 stays
approvedand #81 stays open until it passes.cloudfall auditwill misread the new rule and listener as drift; that's #143.Open a PostgreSQL service to declared sources over TLS (S-006-8, 10) (#…
shipmill-romamo commentedon Oct 27, 2026
Released in v0.8.0rc7 (pre-release). uv tool install --prerelease allow cloudfall==0.8.0rc7
A plain install gets it with the next stable release.
If you filed this: react 👍 on this comment once it works for you, or reply if it doesn't.