RoyDumblauskas/homelab-config
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Change user naming format to start using more explicit connection rules

Browse Source
This commit is contained in:
RoyDumblauskas
2025-11-21 17:36:26 -06:00
parent efed7d0e81
commit 0af530f49c
1 changed files with 13 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
homelab-services/postgresql-db/flake.nix
+13 -21
View File
@@ -29,12 +29,13 @@
type = lib.types.path; type = lib.types.path;
description = '' description = ''
File containing postgresql user credentials. File containing postgresql user credentials.
Format: Only the Passwords. Names of Users just follow the pattern:
<DB_Name>_produser
PSQL_DB_USER=username <DB_Name>_devuser
PSQL_DB_PASSWORD=password
PSQL_DB_DEV_USER=dev_username Password Format:
PSQL_DB_DEV_PASSWORD=dev_password PSQL_<DB>_PASSWORD=password
PSQL_<DB>_DEV_PASSWORD=dev_password
''; '';
}; };
@@ -63,11 +64,11 @@
postgres roy postgres postgres roy postgres
''; '';
# allow remote connections to dev DBs # allow remote connections to dev databases
authentication = '' authentication = ''
${lib.concatStringsSep " " (map (db: "host ${db}_dev all 10.0.0.141/24 md5\n") opts.databases) } ${lib.concatStringsSep " " (map (db: "host ${db}_dev ${db}_devuser 10.0.0.141/24 md5\n") opts.databases) }
${lib.concatStringsSep " " (map (db: "local ${db} ${db}_produser md5\n") opts.databases) }
''; '';
}; };
systemd.services.bootstrap-psql = { systemd.services.bootstrap-psql = {
@@ -90,14 +91,12 @@
for db in ${lib.escapeShellArgs opts.databases}; do for db in ${lib.escapeShellArgs opts.databases}; do
db_upper="''${db^^}" db_upper="''${db^^}"
user_var="PSQL_''${db_upper}_USER"
pass_var="PSQL_''${db_upper}_PASSWORD"
dev_user_var="PSQL_''${db_upper}_DEV_USER" dev_user_var="PSQL_''${db_upper}_DEV_USER"
dev_pass_var="PSQL_''${db_upper}_DEV_PASSWORD" dev_pass_var="PSQL_''${db_upper}_DEV_PASSWORD"
user_val=$(eval "echo \''${$user_var:-}") user_val="$db"_produser
pass_val=$(eval "echo \''${$pass_var:-}") pass_val=$(eval "echo \''${$pass_var:-}")
dev_user_val=$(eval "echo \''${$dev_user_var:-}") dev_user_val="$db"_devuser
dev_pass_val=$(eval "echo \''${$dev_pass_var:-}") dev_pass_val=$(eval "echo \''${$dev_pass_var:-}")
if [ -z "$user_val" ] || [ -z "$pass_val" ]; then if [ -z "$user_val" ] || [ -z "$pass_val" ]; then
@@ -111,10 +110,6 @@
fi fi
echo "Bootstrapping PostgreSQL for database: $db" echo "Bootstrapping PostgreSQL for database: $db"
echo $user_val
echo $pass_val
echo $dev_user_val
echo $dev_pass_val
# Create databases if not exists # Create databases if not exists
if $psql_bin -c "\l" | grep -ci ""$db" "; then if $psql_bin -c "\l" | grep -ci ""$db" "; then
@@ -131,7 +126,6 @@
$psql_bin -c "CREATE DATABASE "$db"_dev;" $psql_bin -c "CREATE DATABASE "$db"_dev;"
fi fi
# Create users if not exists # Create users if not exists
if $psql_bin -c "\du" | grep -ci "$user_val"; then if $psql_bin -c "\du" | grep -ci "$user_val"; then
echo "$user_val already exists, skipping creation. WARN: password may not be correct. Delete user and allow to be recreated for assurity" echo "$user_val already exists, skipping creation. WARN: password may not be correct. Delete user and allow to be recreated for assurity"
@@ -156,9 +150,7 @@
}; };
}; };
networking.firewall.allowedTCPPorts = lib.mkMerge [ networking.firewall.allowedTCPPorts = lib.mkIf opts.enable opts.port;
(lib.mkIf opts.enable [ opts.port ])
];
}; };
}; };
}; };