Password file lives in a 700 dir and userlist is 640 postgres, so
non-root status false-DRifted right after a clean apply. Check them
only as root; non-root status still verifies db/ini/tls/listener.
- role ocrt_dev (LOGIN, random password in /var/lib/sysmig/secrets,
not superuser - DB ownership suffices for schema migrations)
- database ocrt_dev owner ocrt_dev
- pgbouncer: listen 0.0.0.0, self-signed CA+cert (SAN=hostname/IPs),
client_tls_sslmode=require, userlist synced from pg_authid (SCRAM
pass-through; pg_hba unchanged)
- two pool aliases: ocrt_dev (transaction) and ocrt_dev_migrate
(session, for advisory-lock-based migration tools)
- 013 status: listen_addr expectation flips once 015 is applied
- GCP firewall tcp:6432 remains a manual step (gcloud cmd in header)
/etc/pgbouncer was 750 postgres:postgres, so "sysmig status" as the
login user false-DRIFTed on the -f check. Dir 755 + ini 644; userlist
(future SCRAM verifiers) stays 640 postgres.
SHOW() pretty-renders units (60s -> '1min'), which broke the post-up
check after a successful apply. Compare pg_settings.setting (base-unit
raw values) instead - rendering-proof.
- runner: export sbin-inclusive PATH (util-linux tools live in /usr/sbin)
- 001: read /proc/swaps instead of swapon(8)
- 005: resolve /dev/disk/by-uuid symlink instead of findfs(8); report ?
(exit 2) when the UUID cannot be resolved
status convention: print one line, exit 0 OK / 1 DRIFT / 2 unknown (e.g.
needs root). sysmig status now shows [applied ✓/✗/?] per migration and
exits 1 on drift. DB checks fall back to peer auth when non-root.
Per https://www.postgresql.org/download/linux/debian/ (manual configuration):
GPG key + deb822 sources (codename-pgdg) + postgresql-18. Skip-check now
requires an 18 cluster. Down also removes the PGDG repo.
- up/down/status interface, history in /var/lib/sysmig/applied
- 001 swap 2GB + swappiness=10, 002-004 trim unneeded daemons (~56MB)
- google-osconfig-agent intentionally kept
- all messages/comments in ASCII English (console font safety)
wan