Skip to content

fix: sync pgbouncer/adminapi sudoers drift #2481

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
brainrake wants to merge 3 commits into
base: develop
Choose a base branch
from
+5 −0
Open

fix: sync pgbouncer/adminapi sudoers drift #2481

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
09f5fb4
fix: add pg_hba fail2ban match from salt
brainrake Sep 22, 2026
c4dc14a
fix: add walg-tuning and postgresql is-active sudo grants from salt
brainrake Sep 22, 2026
9379cb3
Merge branch 'develop' into martonboros/sync-salt-drift
brainrake Sep 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions ansible/files/adminapi.sudoers.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ Cmnd_Alias KONG = /bin/systemctl start kong.service, /bin/systemctl stop kong.se
Cmnd_Alias POSTGREST = /bin/systemctl start postgrest.service, /bin/systemctl stop postgrest.service, /bin/systemctl restart postgrest.service, /bin/systemctl disable postgrest.service, /bin/systemctl enable postgrest.service, /bin/systemctl try-restart postgrest.service
Cmnd_Alias GOTRUE = /bin/systemctl start gotrue.service, /bin/systemctl stop gotrue.service, /bin/systemctl restart gotrue.service, /bin/systemctl reload gotrue.service, /bin/systemctl disable gotrue.service, /bin/systemctl enable gotrue.service, /bin/systemctl try-restart gotrue.service
Cmnd_Alias PGBOUNCER = /bin/systemctl start pgbouncer.service, /bin/systemctl stop pgbouncer.service, /bin/systemctl restart pgbouncer.service, /bin/systemctl disable pgbouncer.service, /bin/systemctl enable pgbouncer.service, /bin/systemctl reload pgbouncer.service, /bin/systemctl try-restart pgbouncer.service
Cmnd_Alias WALG_TUNING = /opt/supabase-admin-agent/supabase-admin-agent walg-tuning, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]* --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]* --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]* --disk-throughput=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]* --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=* --disk-throughput=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=* --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]* --disk-iops=[0-9]* --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-throughput=[0-9]* --disk-type=* --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]* --disk-throughput=[0-9]* --disk-type=*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-iops=[0-9]* --disk-type=* --disk-throughput=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=* --disk-throughput=[0-9]* --disk-iops=[0-9]*, /opt/supabase-admin-agent/supabase-admin-agent walg-tuning --disk-type=* --disk-iops=[0-9]* --disk-throughput=[0-9]*

%adminapi ALL= NOPASSWD: /root/grow_fs.sh
%adminapi ALL= NOPASSWD: /root/mount-volume.sh
Expand Down Expand Up @@ -32,6 +33,7 @@ Cmnd_Alias PGBOUNCER = /bin/systemctl start pgbouncer.service, /bin/systemctl st
%adminapi ALL= NOPASSWD: /usr/bin/systemctl stop postgresql.service
%adminapi ALL= NOPASSWD: /usr/bin/systemctl reload postgresql.service
%adminapi ALL= NOPASSWD: /usr/bin/systemctl restart postgresql.service
%adminapi ALL= NOPASSWD: /usr/bin/systemctl is-active postgresql.service
%adminapi ALL= NOPASSWD: /usr/bin/systemctl show -p NRestarts postgresql.service
%adminapi ALL= NOPASSWD: /usr/bin/systemctl restart adminapi.service
%adminapi ALL= NOPASSWD: /usr/bin/systemctl is-active commence-backup.service
Expand All @@ -47,3 +49,4 @@ Cmnd_Alias PGBOUNCER = /bin/systemctl start pgbouncer.service, /bin/systemctl st
%adminapi ALL= NOPASSWD: POSTGREST
%adminapi ALL= NOPASSWD: GOTRUE
%adminapi ALL= NOPASSWD: PGBOUNCER
%adminapi ALL=(supabase-admin-agent) NOPASSWD: WALG_TUNING
2 changes: 2 additions & 0 deletions ansible/files/fail2ban_config/filter-pgbouncer.conf.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,4 +5,6 @@ maxlines = 3
failregex = ^.+@<HOST>:.+password authentication failed$
^.+@<HOST>:.+pooler error: no such user$
^.+@<HOST>:.+registered new auto-database.*\n.*\n.*server login failed: FATAL database ".+" does not exist.*$
^.*no pg_hba\.conf entry for host "<HOST>",.*$
ignoreregex = ^.*,.*,.*,.*,"127\.0\.0\.1.*password authentication failed for user.*$
journalmatch = _SYSTEMD_UNIT=pgbouncer.service
Loading