From c639b5397f4df861353de11c1eb3096bbf09fbde Mon Sep 17 00:00:00 2001
From: iwanhae <iwanhae@gmail.com>
Date: Mon, 31 Aug 2026 22:26:00 +0900
Subject: [PATCH] 013: make config dir/ini readable so non-root status works

/etc/pgbouncer was 750 postgres:postgres, so "sysmig status" as the
login user false-DRIFTed on the -f check. Dir 755 + ini 644; userlist
(future SCRAM verifiers) stays 640 postgres.
---
 migrations/013-install-pgbouncer.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/migrations/013-install-pgbouncer.sh b/migrations/013-install-pgbouncer.sh
index c3b1415..480dcb9 100644
--- a/migrations/013-install-pgbouncer.sh
+++ b/migrations/013-install-pgbouncer.sh
@@ -27,7 +27,9 @@ USERLIST=/etc/pgbouncer/userlist.txt
 LOG=/var/log/postgresql/pgbouncer.log
 
 write_ini() {
-  install -d -o postgres -g postgres -m 750 /etc/pgbouncer
+  # dir 755 + ini 644 so non-root `sysmig status` can verify; the only
+  # sensitive file is userlist.txt (SCRAM verifiers) - stays 640 postgres
+  install -d -m 755 /etc/pgbouncer
   cat > "$INI" <<'EOF'
 ;; managed by sysmig 013-install-pgbouncer - serverless connection pooler
 [databases]
@@ -65,7 +67,7 @@ pidfile = /var/run/postgresql/pgbouncer.pid
 user = postgres
 EOF
   chown postgres:postgres "$INI"
-  chmod 640 "$INI"
+  chmod 644 "$INI"
 }
 
 case "${1:-}" in