wan/sysmig
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

015: run secrets/userlist drift checks as root only

Browse Source 
Password file lives in a 700 dir and userlist is 640 postgres, so
non-root status false-DRifted right after a clean apply. Check them
only as root; non-root status still verifies db/ini/tls/listener.
This commit is contained in:
wan
2026-08-31 22:35:17 +09:00
parent f691e38e93
commit e93861d2c5
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
migrations/015-remote-access.sh
+8 -4
View File
@@ -153,17 +153,21 @@ case "${1:-}" in
|| { echo "DRIFT role $ROLE missing"; exit 1; } || { echo "DRIFT role $ROLE missing"; exit 1; }
[[ $(q "SELECT pg_get_userbyid(datdba) FROM pg_database WHERE datname='$DB'") == "$ROLE" ]] \ [[ $(q "SELECT pg_get_userbyid(datdba) FROM pg_database WHERE datname='$DB'") == "$ROLE" ]] \
|| { echo "DRIFT database $DB missing or not owned by $ROLE"; exit 1; } || { echo "DRIFT database $DB missing or not owned by $ROLE"; exit 1; }
[[ -f $SECRET ]] || { echo "DRIFT password file $SECRET missing"; exit 1; }
[[ -f $TLS/server.crt ]] || { echo "DRIFT TLS cert missing"; exit 1; } [[ -f $TLS/server.crt ]] || { echo "DRIFT TLS cert missing"; exit 1; }
grep -q '^listen_addr = 0.0.0.0' "$INI" || { echo "DRIFT listen_addr not 0.0.0.0"; exit 1; } grep -q '^listen_addr = 0.0.0.0' "$INI" || { echo "DRIFT listen_addr not 0.0.0.0"; exit 1; }
grep -q "^$DB = host=" "$INI" || { echo "DRIFT $DB pool entry missing"; exit 1; } grep -q "^$DB = host=" "$INI" || { echo "DRIFT $DB pool entry missing"; exit 1; }
grep -q '^client_tls_sslmode = require' "$INI" || { echo "DRIFT client TLS not enforced"; exit 1; } grep -q '^client_tls_sslmode = require' "$INI" || { echo "DRIFT client TLS not enforced"; exit 1; }
ver=$(q "SELECT rolpassword FROM pg_authid WHERE rolname='$ROLE'") # root-only checks: password file (700 dir) and userlist (640 postgres)
grep -qF "\"$ver\"" "$USERLIST" || { echo "DRIFT userlist verifier out of sync"; exit 1; } if [[ $EUID -eq 0 ]]; then
[[ -f $SECRET ]] || { echo "DRIFT password file $SECRET missing"; exit 1; }
ver=$(q "SELECT rolpassword FROM pg_authid WHERE rolname='$ROLE'")
grep -qF "\"$ver\"" "$USERLIST" || { echo "DRIFT userlist verifier out of sync"; exit 1; }
note="userlist synced, "
fi
systemctl is-active --quiet pgbouncer || { echo "DRIFT pgbouncer not active"; exit 1; } systemctl is-active --quiet pgbouncer || { echo "DRIFT pgbouncer not active"; exit 1; }
ss -ltn 2>/dev/null | grep -q '0.0.0.0:6432' \ ss -ltn 2>/dev/null | grep -q '0.0.0.0:6432' \
|| { echo "DRIFT not listening on 0.0.0.0:6432"; exit 1; } || { echo "DRIFT not listening on 0.0.0.0:6432"; exit 1; }
echo "OK role+db $ROLE, TLS enforced, listening on 0.0.0.0:6432" echo "OK role+db $ROLE, TLS enforced, ${note:-}listening on 0.0.0.0:6432"
;; ;;
down) down)
if db_exists; then if db_exists; then