Repository navigation
Prove S-006-9 on a live pair of hosts (PostgreSQL remoteAccess over TLS) #145
Description
The last criterion of spec S-006 (docs/specs/006-standalone-postgresql.md, feature issue #81) needs a live proving run on two hosts, which no agent session runs on its own (it creates paid cloud servers):
- S-006-9: On a proving pair of hosts,
psqlfrom an address inallowedSourcesasbillingwithsslmode=requireconnects, from an address outside it gets no connection, and from an allowed address withsslmode=disableis refused withno pg_hba.conf entry
Everything else in S-006 is merged (#131, #139, #141). The pattern is the disposable two-host proving run used for M10: two cx23 hosts, one with the PostgreSQL service and remoteAccess (listenAddress its private address, allowedSources the other host's /32), cloudfall converge baseline and services, then the three psql attempts from the second host, then delete both hosts.
When it passes, set spec 006 to status: built with the run in its Verification section (a docs PR), and #81 can close.
Check
From the second host (in allowedSources):
psql "host=<listenAddress> dbname=billing user=billing sslmode=require" -c 'select 1'returns1psql "host=<listenAddress> dbname=billing user=billing sslmode=disable" -c 'select 1'fails withno pg_hba.conf entry
From a third address outside allowedSources: the same sslmode=require command gets no connection (times out or is refused).
Activity
shipmill-romamo commentedon Oct 27, 2026
@romamo This one is yours: the live two-host run for S-006-9 creates paid servers, so no agent session starts it. Everything it needs is merged on main (#139, #141). When the
## Checkabove holds, close this issue. The next gate pass will see it, run the check's record into spec 006's Verification section, and close #81.shipmill-romamo commentedon Oct 27, 2026
@romamo, it's your turn: #139 and #141 merged, so everything S-006-9 needs is on main.
What to do, from this issue:
When it's done, this must hold:
Note: until #143 lands,
cloudfall auditon the PostgreSQL host reports false drift for port 5432; ignore it during this run.Reply
donehere with what the three commands returned, or close the issue.