Skip to content

fix: sync pgbouncer/adminapi sudoers drift #2481

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
brainrake merged 7 commits into from
Oct 5, 2026
Merged

fix: sync pgbouncer/adminapi sudoers drift #2481

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
09f5fb4
fix: add pg_hba fail2ban match from salt
brainrake Sep 22, 2026
c4dc14a
fix: add walg-tuning and postgresql is-active sudo grants from salt
brainrake Sep 22, 2026
9379cb3
Merge branch 'develop' into martonboros/sync-salt-drift
brainrake Sep 23, 2026
b9e448d
Merge branch 'develop' into martonboros/sync-salt-drift
brainrake Sep 30, 2026
f483014
fix: sync adminapi sudoers with salt main
brainrake Oct 2, 2026
30972ad
fix: validate adminapi sudoers before install
brainrake Oct 2, 2026
6150938
fix(ansible): drop rightsize_priv, leave sudoers sync to postgres#2498
brainrake Oct 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions ansible/files/adminapi.sudoers.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ Cmnd_Alias KONG = /bin/systemctl start kong.service, /bin/systemctl stop kong.se
Cmnd_Alias POSTGREST = /bin/systemctl start postgrest.service, /bin/systemctl stop postgrest.service, /bin/systemctl restart postgrest.service, /bin/systemctl disable postgrest.service, /bin/systemctl enable postgrest.service, /bin/systemctl try-restart postgrest.service
Cmnd_Alias GOTRUE = /bin/systemctl start gotrue.service, /bin/systemctl stop gotrue.service, /bin/systemctl restart gotrue.service, /bin/systemctl reload gotrue.service, /bin/systemctl disable gotrue.service, /bin/systemctl enable gotrue.service, /bin/systemctl try-restart gotrue.service
Cmnd_Alias PGBOUNCER = /bin/systemctl start pgbouncer.service, /bin/systemctl stop pgbouncer.service, /bin/systemctl restart pgbouncer.service, /bin/systemctl disable pgbouncer.service, /bin/systemctl enable pgbouncer.service, /bin/systemctl reload pgbouncer.service, /bin/systemctl try-restart pgbouncer.service
Cmnd_Alias WALG_TUNING = /opt/supabase-admin-agent/supabase-admin-agent walg-tuning, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]* --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]* --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]* --disk-throughput=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]* --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=* --disk-throughput=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=* --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]* --disk-iops=[0-9]* --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]* --disk-type=* --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]* --disk-throughput=[0-9]* --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]* --disk-type=* --disk-throughput=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=* --disk-throughput=[0-9]* --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=* --disk-iops=[0-9]* --disk-throughput=[0-9]*

%adminapi ALL= NOPASSWD: /root/grow_fs.sh
%adminapi ALL= NOPASSWD: /root/mount-volume.sh
Expand All @@ -29,9 +30,10 @@ Cmnd_Alias PGBOUNCER = /bin/systemctl start pgbouncer.service, /bin/systemctl st
%adminapi ALL=(pgbackrest) NOPASSWD: /usr/bin/pgbackrest
# pgBackRest restore stops PostgreSQL, restores PGDATA, then starts PostgreSQL.
%adminapi ALL= NOPASSWD: /usr/bin/systemctl start postgresql.service
%adminapi ALL= NOPASSWD: /usr/bin/systemctl stop postgresql.service
%adminapi ALL= NOPASSWD: /usr/bin/systemctl reload postgresql.service
%adminapi ALL= NOPASSWD: /usr/bin/systemctl restart postgresql.service
%adminapi ALL= NOPASSWD: /usr/bin/systemctl stop postgresql.service
%adminapi ALL= NOPASSWD: /usr/bin/systemctl is-active postgresql.service
%adminapi ALL= NOPASSWD: /usr/bin/systemctl show -p NRestarts postgresql.service
%adminapi ALL= NOPASSWD: /usr/bin/systemctl restart adminapi.service
%adminapi ALL= NOPASSWD: /usr/bin/systemctl is-active commence-backup.service
Expand All @@ -41,9 +43,10 @@ Cmnd_Alias PGBOUNCER = /bin/systemctl start pgbouncer.service, /bin/systemctl st
%adminapi ALL= NOPASSWD: /usr/sbin/nft -f /etc/nftables/supabase_managed.conf
%adminapi ALL= NOPASSWD: /usr/bin/admin-mgr
%adminapi ALL= NOPASSWD: /usr/sbin/netplan apply
%adminapi ALL= NOPASSWD: /usr/bin/cloud-init clean --logs
%adminapi ALL= NOPASSWD: ENVOY
%adminapi ALL= NOPASSWD: KONG
%adminapi ALL= NOPASSWD: POSTGREST
%adminapi ALL= NOPASSWD: GOTRUE
%adminapi ALL= NOPASSWD: PGBOUNCER
%adminapi ALL=(supabase-admin-agent) NOPASSWD: WALG_TUNING
Comment thread
mmlb marked this conversation as resolved.
%adminapi ALL= NOPASSWD: /usr/bin/cloud-init clean --logs
2 changes: 2 additions & 0 deletions ansible/files/fail2ban_config/filter-pgbouncer.conf.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,4 +5,6 @@ maxlines = 3
failregex = ^.+@<HOST>:.+password authentication failed$
^.+@<HOST>:.+pooler error: no such user$
^.+@<HOST>:.+registered new auto-database.*\n.*\n.*server login failed: FATAL database ".+" does not exist.*$
^.*no pg_hba\.conf entry for host "<HOST>",.*$
ignoreregex = ^.*,.*,.*,.*,"127\.0\.0\.1.*password authentication failed for user.*$
journalmatch = _SYSTEMD_UNIT=pgbouncer.service
1 change: 1 addition & 0 deletions ansible/tasks/internal/admin-api.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@
src: files/adminapi.sudoers.conf
dest: /etc/sudoers.d/adminapi
mode: "0440"
validate: 'visudo -cf %s'

- name: perms for adminapi
shell: |
Expand Down
Loading