Open
Conversation
Crispy1975
force-pushed
the
pjc/indata-403-admin-agent-pgbackrest
branch
from
8f44ad4 to
2370c92
Compare
hunleyd
requested changes
Mar 31, 2026
- pgdata-signal: add remove-pid action to remove stale postmaster.pid via the constrained wrapper rather than a broad sudo rm entry, keeping the sudoers scope limited to this script
Crispy1975
force-pushed
the
pjc/indata-403-admin-agent-pgbackrest
branch
from
2370c92 to
d1b6678
Compare
- pgdata-chown: simplify case; use group=postgres consistently for both ownership targets (pgbackrest:postgres and postgres:postgres) - pgdata-signal: consolidate recovery/standby case into single pattern - pgdata-signal: deploy at mode 0755 so postgres can execute via sudo -u - setup-pgbackrest.yml: combine dir creation into single task with dict loop; conf.d gets 02770 setgid, others get default 0770 - setup-pgbackrest.yml: sort logrotate task keys alphabetically
Three gaps found by cross-referencing SAA commands against Ansible:
1. adminapi.sudoers.conf: add two entries so adminapi can call the
pgbackrest binary via the wrapper.
- NewRunner() path: wrapper calls sudo -u pgbackrest <real binary>,
requires adminapi -> pgbackrest NOPASSWD for the real binary path.
- NewRunnerAs("pgbackrest") path: SAA does sudo -n -u pgbackrest
/usr/bin/pgbackrest, requires adminapi -> pgbackrest NOPASSWD for
the wrapper path.
2. setup-pgbackrest.yml: add pgbackrest -> pgbackrest sudoers entry for
the real binary. When NewRunnerAs runs the wrapper as the pgbackrest
user, the wrapper still calls sudo -u pgbackrest internally; without
this entry that inner sudo fails.
3. setup-pgbackrest.yml: pre-create the three SAA log files
(saa-pgb.log, wal-push.log, wal-fetch.log) as pgbackrest:postgres
0660. SAA opens them with O_APPEND|O_WRONLY (no O_CREATE) — a missing
file causes enable to fail immediately before any pgBackRest work.
modification_time/access_time: preserve means the task is idempotent.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What kind of change does this PR introduce?
Additional config for
pgBackRestbackups and restores. Details further in: https://linear.app/supabase/issue/INDATA-403/admin-agent-add-new-command-to-control-pgbackrest