From 09f5fb4ee5652e7df613a9ee435363546e782f17 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Tue, 22 Sep 2026 19:43:56 +0300 Subject: [PATCH 1/5] fix: add pg_hba fail2ban match from salt Co-Authored-By: Claude Sonnet 5 --- ansible/files/fail2ban_config/filter-pgbouncer.conf.j2 | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ansible/files/fail2ban_config/filter-pgbouncer.conf.j2 b/ansible/files/fail2ban_config/filter-pgbouncer.conf.j2 index 24418cb3a8..b937a26a28 100644 --- a/ansible/files/fail2ban_config/filter-pgbouncer.conf.j2 +++ b/ansible/files/fail2ban_config/filter-pgbouncer.conf.j2 @@ -5,4 +5,6 @@ maxlines = 3 failregex = ^.+@:.+password authentication failed$ ^.+@:.+pooler error: no such user$ ^.+@:.+registered new auto-database.*\n.*\n.*server login failed: FATAL database ".+" does not exist.*$ + ^.*no pg_hba\.conf entry for host "",.*$ +ignoreregex = ^.*,.*,.*,.*,"127\.0\.0\.1.*password authentication failed for user.*$ journalmatch = _SYSTEMD_UNIT=pgbouncer.service From c4dc14a4eac720de130c08ca1bedaf72476472c8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Tue, 22 Sep 2026 20:17:50 +0300 Subject: [PATCH 2/5] fix: add walg-tuning and postgresql is-active sudo grants from salt Co-Authored-By: Claude Sonnet 5 --- ansible/files/adminapi.sudoers.conf | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ansible/files/adminapi.sudoers.conf b/ansible/files/adminapi.sudoers.conf index e6d27bd104..930d76f493 100644 --- a/ansible/files/adminapi.sudoers.conf +++ b/ansible/files/adminapi.sudoers.conf @@ -3,6 +3,7 @@ Cmnd_Alias KONG = /bin/systemctl start kong.service, /bin/systemctl stop kong.se Cmnd_Alias POSTGREST = /bin/systemctl start postgrest.service, /bin/systemctl stop postgrest.service, /bin/systemctl restart postgrest.service, /bin/systemctl disable postgrest.service, /bin/systemctl enable postgrest.service, /bin/systemctl try-restart postgrest.service Cmnd_Alias GOTRUE = /bin/systemctl start gotrue.service, /bin/systemctl stop gotrue.service, /bin/systemctl restart gotrue.service, /bin/systemctl reload gotrue.service, /bin/systemctl disable gotrue.service, /bin/systemctl enable gotrue.service, /bin/systemctl try-restart gotrue.service Cmnd_Alias PGBOUNCER = /bin/systemctl start pgbouncer.service, /bin/systemctl stop pgbouncer.service, /bin/systemctl restart pgbouncer.service, /bin/systemctl disable pgbouncer.service, /bin/systemctl enable pgbouncer.service, /bin/systemctl reload pgbouncer.service, /bin/systemctl try-restart pgbouncer.service +Cmnd_Alias WALG_TUNING = /opt/supabase-admin-agent/supabase-admin-agent walg-tuning, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]* --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]* --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]* --disk-throughput=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]* --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=* --disk-throughput=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=* --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]* --disk-iops=[0-9]* --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]* --disk-type=* --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]* --disk-throughput=[0-9]* --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]* --disk-type=* --disk-throughput=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=* --disk-throughput=[0-9]* --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=* --disk-iops=[0-9]* --disk-throughput=[0-9]* %adminapi ALL= NOPASSWD: /root/grow_fs.sh %adminapi ALL= NOPASSWD: /root/mount-volume.sh @@ -32,6 +33,7 @@ Cmnd_Alias PGBOUNCER = /bin/systemctl start pgbouncer.service, /bin/systemctl st %adminapi ALL= NOPASSWD: /usr/bin/systemctl stop postgresql.service %adminapi ALL= NOPASSWD: /usr/bin/systemctl reload postgresql.service %adminapi ALL= NOPASSWD: /usr/bin/systemctl restart postgresql.service +%adminapi ALL= NOPASSWD: /usr/bin/systemctl is-active postgresql.service %adminapi ALL= NOPASSWD: /usr/bin/systemctl show -p NRestarts postgresql.service %adminapi ALL= NOPASSWD: /usr/bin/systemctl restart adminapi.service %adminapi ALL= NOPASSWD: /usr/bin/systemctl is-active commence-backup.service @@ -46,3 +48,4 @@ Cmnd_Alias PGBOUNCER = /bin/systemctl start pgbouncer.service, /bin/systemctl st %adminapi ALL= NOPASSWD: POSTGREST %adminapi ALL= NOPASSWD: GOTRUE %adminapi ALL= NOPASSWD: PGBOUNCER +%adminapi ALL=(supabase-admin-agent) NOPASSWD: WALG_TUNING From f483014bb7b14b6465a6076650eddb5950f83fff Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Fri, 2 Oct 2026 18:47:46 +0300 Subject: [PATCH 3/5] fix: sync adminapi sudoers with salt main Salt gained postgrest blue/green units, supabase-state, and rightsize grants since this branch was cut. Rightsize is gated on a pillar flag that is off in prod, so the rendered output omits it. The pgBackRest grants exist only here and are kept. Assisted-by: claude-code:claude-opus-5-5 --- ansible/files/adminapi.sudoers.conf | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/ansible/files/adminapi.sudoers.conf b/ansible/files/adminapi.sudoers.conf index 65651abd1a..9dcd0e3cce 100644 --- a/ansible/files/adminapi.sudoers.conf +++ b/ansible/files/adminapi.sudoers.conf @@ -1,6 +1,6 @@ Cmnd_Alias ENVOY = /bin/systemctl start envoy.service, /bin/systemctl stop envoy.service, /bin/systemctl restart envoy.service, /bin/systemctl disable envoy.service, /bin/systemctl enable envoy.service, /bin/systemctl reload envoy.service, /bin/systemctl try-restart envoy.service Cmnd_Alias KONG = /bin/systemctl start kong.service, /bin/systemctl stop kong.service, /bin/systemctl restart kong.service, /bin/systemctl disable kong.service, /bin/systemctl enable kong.service, /bin/systemctl reload kong.service, /bin/systemctl try-restart kong.service -Cmnd_Alias POSTGREST = /bin/systemctl start postgrest.service, /bin/systemctl stop postgrest.service, /bin/systemctl restart postgrest.service, /bin/systemctl disable postgrest.service, /bin/systemctl enable postgrest.service, /bin/systemctl try-restart postgrest.service +Cmnd_Alias POSTGREST = /bin/systemctl start postgrest.service, /bin/systemctl stop postgrest.service, /bin/systemctl restart postgrest.service, /bin/systemctl disable postgrest.service, /bin/systemctl enable postgrest.service, /bin/systemctl try-restart postgrest.service, /bin/systemctl start postgrest@blue.service, /bin/systemctl stop postgrest@blue.service, /bin/systemctl restart postgrest@blue.service, /bin/systemctl disable postgrest@blue.service, /bin/systemctl enable postgrest@blue.service, /bin/systemctl try-restart postgrest@blue.service, /bin/systemctl start postgrest@green.service, /bin/systemctl stop postgrest@green.service, /bin/systemctl restart postgrest@green.service, /bin/systemctl disable postgrest@green.service, /bin/systemctl enable postgrest@green.service, /bin/systemctl try-restart postgrest@green.service Cmnd_Alias GOTRUE = /bin/systemctl start gotrue.service, /bin/systemctl stop gotrue.service, /bin/systemctl restart gotrue.service, /bin/systemctl reload gotrue.service, /bin/systemctl disable gotrue.service, /bin/systemctl enable gotrue.service, /bin/systemctl try-restart gotrue.service Cmnd_Alias PGBOUNCER = /bin/systemctl start pgbouncer.service, /bin/systemctl stop pgbouncer.service, /bin/systemctl restart pgbouncer.service, /bin/systemctl disable pgbouncer.service, /bin/systemctl enable pgbouncer.service, /bin/systemctl reload pgbouncer.service, /bin/systemctl try-restart pgbouncer.service Cmnd_Alias WALG_TUNING = /opt/supabase-admin-agent/supabase-admin-agent walg-tuning, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]* --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]* --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]* --disk-throughput=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]* --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=* --disk-throughput=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=* --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]* --disk-iops=[0-9]* --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]* --disk-type=* --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]* --disk-throughput=[0-9]* --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]* --disk-type=* --disk-throughput=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=* --disk-throughput=[0-9]* --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=* --disk-iops=[0-9]* --disk-throughput=[0-9]* @@ -30,9 +30,9 @@ Cmnd_Alias WALG_TUNING = /opt/supabase-admin-agent/supabase-admin-agent walg-tun %adminapi ALL=(pgbackrest) NOPASSWD: /usr/bin/pgbackrest # pgBackRest restore stops PostgreSQL, restores PGDATA, then starts PostgreSQL. %adminapi ALL= NOPASSWD: /usr/bin/systemctl start postgresql.service -%adminapi ALL= NOPASSWD: /usr/bin/systemctl stop postgresql.service %adminapi ALL= NOPASSWD: /usr/bin/systemctl reload postgresql.service %adminapi ALL= NOPASSWD: /usr/bin/systemctl restart postgresql.service +%adminapi ALL= NOPASSWD: /usr/bin/systemctl stop postgresql.service %adminapi ALL= NOPASSWD: /usr/bin/systemctl is-active postgresql.service %adminapi ALL= NOPASSWD: /usr/bin/systemctl show -p NRestarts postgresql.service %adminapi ALL= NOPASSWD: /usr/bin/systemctl restart adminapi.service @@ -42,11 +42,12 @@ Cmnd_Alias WALG_TUNING = /opt/supabase-admin-agent/supabase-admin-agent walg-tun %adminapi ALL= NOPASSWD: /bin/systemctl restart services.slice %adminapi ALL= NOPASSWD: /usr/sbin/nft -f /etc/nftables/supabase_managed.conf %adminapi ALL= NOPASSWD: /usr/bin/admin-mgr +%adminapi ALL= NOPASSWD: /opt/supabase-state/supabase-state %adminapi ALL= NOPASSWD: /usr/sbin/netplan apply -%adminapi ALL= NOPASSWD: /usr/bin/cloud-init clean --logs %adminapi ALL= NOPASSWD: ENVOY %adminapi ALL= NOPASSWD: KONG %adminapi ALL= NOPASSWD: POSTGREST %adminapi ALL= NOPASSWD: GOTRUE %adminapi ALL= NOPASSWD: PGBOUNCER %adminapi ALL=(supabase-admin-agent) NOPASSWD: WALG_TUNING +%adminapi ALL= NOPASSWD: /usr/bin/cloud-init clean --logs From 30972ad94689fc6259e06bbfca9a619e9ec37999 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Fri, 2 Oct 2026 18:47:46 +0300 Subject: [PATCH 4/5] fix: validate adminapi sudoers before install A malformed file in /etc/sudoers.d breaks sudo for every user. Salt already checks it with visudo; match that here. Assisted-by: claude-code:claude-opus-5-5 --- ansible/tasks/internal/admin-api.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/ansible/tasks/internal/admin-api.yml b/ansible/tasks/internal/admin-api.yml index be1673a5b6..0eaced09e7 100644 --- a/ansible/tasks/internal/admin-api.yml +++ b/ansible/tasks/internal/admin-api.yml @@ -29,6 +29,7 @@ src: files/adminapi.sudoers.conf dest: /etc/sudoers.d/adminapi mode: "0440" + validate: 'visudo -cf %s' - name: perms for adminapi shell: | From 61509385ff271c7dabc7aee1928711c394ead190 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Mon, 5 Oct 2026 03:44:03 +0300 Subject: [PATCH 5/5] fix(ansible): drop rightsize_priv, leave sudoers sync to postgres#2498 Refs: MPG-1243 Co-Authored-By: Claude Sonnet 5 --- ansible/files/adminapi.sudoers.conf | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/ansible/files/adminapi.sudoers.conf b/ansible/files/adminapi.sudoers.conf index 9dcd0e3cce..5c07436813 100644 --- a/ansible/files/adminapi.sudoers.conf +++ b/ansible/files/adminapi.sudoers.conf @@ -1,6 +1,6 @@ Cmnd_Alias ENVOY = /bin/systemctl start envoy.service, /bin/systemctl stop envoy.service, /bin/systemctl restart envoy.service, /bin/systemctl disable envoy.service, /bin/systemctl enable envoy.service, /bin/systemctl reload envoy.service, /bin/systemctl try-restart envoy.service Cmnd_Alias KONG = /bin/systemctl start kong.service, /bin/systemctl stop kong.service, /bin/systemctl restart kong.service, /bin/systemctl disable kong.service, /bin/systemctl enable kong.service, /bin/systemctl reload kong.service, /bin/systemctl try-restart kong.service -Cmnd_Alias POSTGREST = /bin/systemctl start postgrest.service, /bin/systemctl stop postgrest.service, /bin/systemctl restart postgrest.service, /bin/systemctl disable postgrest.service, /bin/systemctl enable postgrest.service, /bin/systemctl try-restart postgrest.service, /bin/systemctl start postgrest@blue.service, /bin/systemctl stop postgrest@blue.service, /bin/systemctl restart postgrest@blue.service, /bin/systemctl disable postgrest@blue.service, /bin/systemctl enable postgrest@blue.service, /bin/systemctl try-restart postgrest@blue.service, /bin/systemctl start postgrest@green.service, /bin/systemctl stop postgrest@green.service, /bin/systemctl restart postgrest@green.service, /bin/systemctl disable postgrest@green.service, /bin/systemctl enable postgrest@green.service, /bin/systemctl try-restart postgrest@green.service +Cmnd_Alias POSTGREST = /bin/systemctl start postgrest.service, /bin/systemctl stop postgrest.service, /bin/systemctl restart postgrest.service, /bin/systemctl disable postgrest.service, /bin/systemctl enable postgrest.service, /bin/systemctl try-restart postgrest.service Cmnd_Alias GOTRUE = /bin/systemctl start gotrue.service, /bin/systemctl stop gotrue.service, /bin/systemctl restart gotrue.service, /bin/systemctl reload gotrue.service, /bin/systemctl disable gotrue.service, /bin/systemctl enable gotrue.service, /bin/systemctl try-restart gotrue.service Cmnd_Alias PGBOUNCER = /bin/systemctl start pgbouncer.service, /bin/systemctl stop pgbouncer.service, /bin/systemctl restart pgbouncer.service, /bin/systemctl disable pgbouncer.service, /bin/systemctl enable pgbouncer.service, /bin/systemctl reload pgbouncer.service, /bin/systemctl try-restart pgbouncer.service Cmnd_Alias WALG_TUNING = /opt/supabase-admin-agent/supabase-admin-agent walg-tuning, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]* --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]* --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]* --disk-throughput=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]* --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=* --disk-throughput=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=* --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]* --disk-iops=[0-9]* --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]* --disk-type=* --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]* --disk-throughput=[0-9]* --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]* --disk-type=* --disk-throughput=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=* --disk-throughput=[0-9]* --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=* --disk-iops=[0-9]* --disk-throughput=[0-9]* @@ -42,7 +42,6 @@ Cmnd_Alias WALG_TUNING = /opt/supabase-admin-agent/supabase-admin-agent walg-tun %adminapi ALL= NOPASSWD: /bin/systemctl restart services.slice %adminapi ALL= NOPASSWD: /usr/sbin/nft -f /etc/nftables/supabase_managed.conf %adminapi ALL= NOPASSWD: /usr/bin/admin-mgr -%adminapi ALL= NOPASSWD: /opt/supabase-state/supabase-state %adminapi ALL= NOPASSWD: /usr/sbin/netplan apply %adminapi ALL= NOPASSWD: ENVOY %adminapi ALL= NOPASSWD: KONG