From ec82ae3c394600f79c2971ffca7b87a4f574cfea Mon Sep 17 00:00:00 2001 From: Aaron Andersen Date: Wed, 12 Aug 2020 21:06:31 -0400 Subject: [PATCH 1/2] nixos/postgresql: run ExecStartPost as an unprivileged user --- nixos/doc/manual/release-notes/rl-2009.xml | 10 +++++++++- nixos/modules/services/databases/postgresql.nix | 13 +++++++------ 2 files changed, 16 insertions(+), 7 deletions(-) diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml index 85679e48272..71667c854bc 100644 --- a/nixos/doc/manual/release-notes/rl-2009.xml +++ b/nixos/doc/manual/release-notes/rl-2009.xml @@ -666,11 +666,19 @@ services.dokuwiki."mywiki" = { The option is now set to "/var/lib/postgresql/${cfg.package.psqlSchema}" regardless of your - . Users with an existing postgresql install that have a of 17.09 or below + . Users with an existing postgresql install that have a of 17.03 or below should double check what the value of their option is (/var/db/postgresql) and then explicitly set this value to maintain compatibility: services.postgresql.dataDir = "/var/db/postgresql"; + + + + The postgresql module now expects there to be a database super user account called postgres regardless of your . Users + with an existing postgresql install that have a of 17.03 or below should run the following SQL statements as a + database super admin user before upgrading: + +CREATE ROLE postgres LOGIN SUPERUSER; diff --git a/nixos/modules/services/databases/postgresql.nix b/nixos/modules/services/databases/postgresql.nix index 3e16b5907dd..2bb2ba73996 100644 --- a/nixos/modules/services/databases/postgresql.nix +++ b/nixos/modules/services/databases/postgresql.nix @@ -225,14 +225,15 @@ in Contents of the recovery.conf file. ''; }; + superUser = mkOption { type = types.str; - default= if versionAtLeast config.system.stateVersion "17.09" then "postgres" else "root"; + default = "postgres"; internal = true; + readOnly = true; description = '' - NixOS traditionally used 'root' as superuser, most other distros use 'postgres'. - From 17.09 we also try to follow this standard. Internal since changing this value - would lead to breakage while setting up databases. + PostgreSQL superuser account to use for various operations. Internal since changing + this value would lead to breakage while setting up databases. ''; }; }; @@ -336,7 +337,7 @@ in setupScript = pkgs.writeScript "postgresql-setup" ('' #!${pkgs.runtimeShell} -e - PSQL="${pkgs.utillinux}/bin/runuser -u ${cfg.superUser} -- psql --port=${toString cfg.port}" + PSQL="psql --port=${toString cfg.port}" while ! $PSQL -d postgres -c "" 2> /dev/null; do if ! kill -0 "$MAINPID"; then exit 1; fi @@ -362,7 +363,7 @@ in '') cfg.ensureUsers} ''); in - "+${setupScript}"; + "${setupScript}"; } (mkIf (cfg.dataDir == "/var/lib/postgresql/${cfg.package.psqlSchema}") { StateDirectory = "postgresql postgresql/${cfg.package.psqlSchema}"; From 8e045b42fd90d8934ecf73977befc894b6171b78 Mon Sep 17 00:00:00 2001 From: Aaron Andersen Date: Wed, 12 Aug 2020 21:12:24 -0400 Subject: [PATCH 2/2] nixos/postgresql: move ExecStartPost into postStart --- .../modules/services/databases/postgresql.nix | 63 +++++++++---------- 1 file changed, 29 insertions(+), 34 deletions(-) diff --git a/nixos/modules/services/databases/postgresql.nix b/nixos/modules/services/databases/postgresql.nix index 2bb2ba73996..c726a08e34f 100644 --- a/nixos/modules/services/databases/postgresql.nix +++ b/nixos/modules/services/databases/postgresql.nix @@ -311,6 +311,35 @@ in ''} ''; + # Wait for PostgreSQL to be ready to accept connections. + postStart = + '' + PSQL="psql --port=${toString cfg.port}" + + while ! $PSQL -d postgres -c "" 2> /dev/null; do + if ! kill -0 "$MAINPID"; then exit 1; fi + sleep 0.1 + done + + if test -e "${cfg.dataDir}/.first_startup"; then + ${optionalString (cfg.initialScript != null) '' + $PSQL -f "${cfg.initialScript}" -d postgres + ''} + rm -f "${cfg.dataDir}/.first_startup" + fi + '' + optionalString (cfg.ensureDatabases != []) '' + ${concatMapStrings (database: '' + $PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = '${database}'" | grep -q 1 || $PSQL -tAc 'CREATE DATABASE "${database}"' + '') cfg.ensureDatabases} + '' + '' + ${concatMapStrings (user: '' + $PSQL -tAc "SELECT 1 FROM pg_roles WHERE rolname='${user.name}'" | grep -q 1 || $PSQL -tAc 'CREATE USER "${user.name}"' + ${concatStringsSep "\n" (mapAttrsToList (database: permission: '' + $PSQL -tAc 'GRANT ${permission} ON ${database} TO "${user.name}"' + '') user.ensurePermissions)} + '') cfg.ensureUsers} + ''; + serviceConfig = mkMerge [ { ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID"; User = "postgres"; @@ -330,40 +359,6 @@ in TimeoutSec = 120; ExecStart = "${postgresql}/bin/postgres"; - - # Wait for PostgreSQL to be ready to accept connections. - ExecStartPost = - let - setupScript = pkgs.writeScript "postgresql-setup" ('' - #!${pkgs.runtimeShell} -e - - PSQL="psql --port=${toString cfg.port}" - - while ! $PSQL -d postgres -c "" 2> /dev/null; do - if ! kill -0 "$MAINPID"; then exit 1; fi - sleep 0.1 - done - - if test -e "${cfg.dataDir}/.first_startup"; then - ${optionalString (cfg.initialScript != null) '' - $PSQL -f "${cfg.initialScript}" -d postgres - ''} - rm -f "${cfg.dataDir}/.first_startup" - fi - '' + optionalString (cfg.ensureDatabases != []) '' - ${concatMapStrings (database: '' - $PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = '${database}'" | grep -q 1 || $PSQL -tAc 'CREATE DATABASE "${database}"' - '') cfg.ensureDatabases} - '' + '' - ${concatMapStrings (user: '' - $PSQL -tAc "SELECT 1 FROM pg_roles WHERE rolname='${user.name}'" | grep -q 1 || $PSQL -tAc 'CREATE USER "${user.name}"' - ${concatStringsSep "\n" (mapAttrsToList (database: permission: '' - $PSQL -tAc 'GRANT ${permission} ON ${database} TO "${user.name}"' - '') user.ensurePermissions)} - '') cfg.ensureUsers} - ''); - in - "${setupScript}"; } (mkIf (cfg.dataDir == "/var/lib/postgresql/${cfg.package.psqlSchema}") { StateDirectory = "postgresql postgresql/${cfg.package.psqlSchema}";