From 09f5fb4ee5652e7df613a9ee435363546e782f17 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Tue, 22 Sep 2026 19:43:56 +0300 Subject: [PATCH 1/2] fix: add pg_hba fail2ban match from salt Co-Authored-By: Claude Sonnet 5 --- ansible/files/fail2ban_config/filter-pgbouncer.conf.j2 | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ansible/files/fail2ban_config/filter-pgbouncer.conf.j2 b/ansible/files/fail2ban_config/filter-pgbouncer.conf.j2 index 24418cb3a8..b937a26a28 100644 --- a/ansible/files/fail2ban_config/filter-pgbouncer.conf.j2 +++ b/ansible/files/fail2ban_config/filter-pgbouncer.conf.j2 @@ -5,4 +5,6 @@ maxlines = 3 failregex = ^.+@:.+password authentication failed$ ^.+@:.+pooler error: no such user$ ^.+@:.+registered new auto-database.*\n.*\n.*server login failed: FATAL database ".+" does not exist.*$ + ^.*no pg_hba\.conf entry for host "",.*$ +ignoreregex = ^.*,.*,.*,.*,"127\.0\.0\.1.*password authentication failed for user.*$ journalmatch = _SYSTEMD_UNIT=pgbouncer.service From c4dc14a4eac720de130c08ca1bedaf72476472c8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Tue, 22 Sep 2026 20:17:50 +0300 Subject: [PATCH 2/2] fix: add walg-tuning and postgresql is-active sudo grants from salt Co-Authored-By: Claude Sonnet 5 --- ansible/files/adminapi.sudoers.conf | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ansible/files/adminapi.sudoers.conf b/ansible/files/adminapi.sudoers.conf index e6d27bd104..930d76f493 100644 --- a/ansible/files/adminapi.sudoers.conf +++ b/ansible/files/adminapi.sudoers.conf @@ -3,6 +3,7 @@ Cmnd_Alias KONG = /bin/systemctl start kong.service, /bin/systemctl stop kong.se Cmnd_Alias POSTGREST = /bin/systemctl start postgrest.service, /bin/systemctl stop postgrest.service, /bin/systemctl restart postgrest.service, /bin/systemctl disable postgrest.service, /bin/systemctl enable postgrest.service, /bin/systemctl try-restart postgrest.service Cmnd_Alias GOTRUE = /bin/systemctl start gotrue.service, /bin/systemctl stop gotrue.service, /bin/systemctl restart gotrue.service, /bin/systemctl reload gotrue.service, /bin/systemctl disable gotrue.service, /bin/systemctl enable gotrue.service, /bin/systemctl try-restart gotrue.service Cmnd_Alias PGBOUNCER = /bin/systemctl start pgbouncer.service, /bin/systemctl stop pgbouncer.service, /bin/systemctl restart pgbouncer.service, /bin/systemctl disable pgbouncer.service, /bin/systemctl enable pgbouncer.service, /bin/systemctl reload pgbouncer.service, /bin/systemctl try-restart pgbouncer.service +Cmnd_Alias WALG_TUNING = /opt/supabase-admin-agent/supabase-admin-agent walg-tuning, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]* --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]* --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]* --disk-throughput=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]* --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=* --disk-throughput=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=* --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]* --disk-iops=[0-9]* --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]* --disk-type=* --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]* --disk-throughput=[0-9]* --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]* --disk-type=* --disk-throughput=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=* --disk-throughput=[0-9]* --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=* --disk-iops=[0-9]* --disk-throughput=[0-9]* %adminapi ALL= NOPASSWD: /root/grow_fs.sh %adminapi ALL= NOPASSWD: /root/mount-volume.sh @@ -32,6 +33,7 @@ Cmnd_Alias PGBOUNCER = /bin/systemctl start pgbouncer.service, /bin/systemctl st %adminapi ALL= NOPASSWD: /usr/bin/systemctl stop postgresql.service %adminapi ALL= NOPASSWD: /usr/bin/systemctl reload postgresql.service %adminapi ALL= NOPASSWD: /usr/bin/systemctl restart postgresql.service +%adminapi ALL= NOPASSWD: /usr/bin/systemctl is-active postgresql.service %adminapi ALL= NOPASSWD: /usr/bin/systemctl show -p NRestarts postgresql.service %adminapi ALL= NOPASSWD: /usr/bin/systemctl restart adminapi.service %adminapi ALL= NOPASSWD: /usr/bin/systemctl is-active commence-backup.service @@ -46,3 +48,4 @@ Cmnd_Alias PGBOUNCER = /bin/systemctl start pgbouncer.service, /bin/systemctl st %adminapi ALL= NOPASSWD: POSTGREST %adminapi ALL= NOPASSWD: GOTRUE %adminapi ALL= NOPASSWD: PGBOUNCER +%adminapi ALL=(supabase-admin-agent) NOPASSWD: WALG_TUNING