Postgresql database for storing TF states

pim commented

2023-11-22 11:33:45 +00:00

Owner

https://nixos.wiki/wiki/PostgreSQL
https://www.postgresql.org/docs/current/ssl-tcp.html

Forcing server SSL cert checking:
https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNECT-SSLCERTMODE

Setting root certificate of server:
https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNECT-SSLROOTCERT

Environmental variables for options:
https://www.postgresql.org/docs/current/libpq-envars.html

Maybe nice to do mutual SSL instead of passwords.

Should use sslmode == require which doesn't check hostname and we don't have to put that into the certificate.

https://nixos.wiki/wiki/PostgreSQL https://www.postgresql.org/docs/current/ssl-tcp.html Forcing server SSL cert checking: https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNECT-SSLCERTMODE Setting root certificate of server: https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNECT-SSLROOTCERT Environmental variables for options: https://www.postgresql.org/docs/current/libpq-envars.html Maybe nice to do mutual SSL instead of passwords. Should use `sslmode == require` which doesn't check hostname and we don't have to put that into the certificate.

pim referenced this issue

2023-11-22 11:34:17 +00:00

Libvirt virtual machines #9

pim commented

2023-11-23 21:25:13 +00:00

Author

Owner

Thought of an interesting potential problem. If we have a data directory for postgresql, with a matching UID and GID, how can we guarantee that the postgresql service can access these files? The service needs to have the same UID and GID. However, if we just let Nix create the user and group, a random unused UID and GID are chosen. Therefore we need to declare this user and group beforehand.

Update: this is not actually a problem, because NixOS uses ids.uids.postgres and ids.gids.postgres, which are static values. Not sure how this works on other distros, but NixOS fixes this at least.

Thought of an interesting potential problem. If we have a data directory for postgresql, with a matching UID and GID, how can we guarantee that the postgresql service can access these files? The service needs to have the same UID and GID. However, if we just let Nix create the user and group, a random unused UID and GID are chosen. Therefore we need to declare this user and group beforehand. Update: this is not actually a problem, because NixOS uses ids.uids.postgres and ids.gids.postgres, which are static values. Not sure how this works on other distros, but NixOS fixes this at least.

pim closed this issue

2023-11-25 13:58:24 +00:00

Postgresql database for storing TF states #10