psa-systems/mokosh-server
Watch
9
0
Fork
You've already forked mokosh-server
 1
Code Issues Pull requests Projects Releases 10 Packages Wiki Activity Actions

fix(dev): pre-create pg extensions + grant CREATE-on-db for fresh split-role volume #251

Merged
longjacksonle merged 1 commit from fix/dev-pg-preinstall-extensions into main 2026-06-15 21:46:43 +02:00
Conversation 0 Commits 1 Files changed 1 +18
longjacksonle commented 2026-06-15 21:46:31 +02:00
Owner
Copy link

On a fresh Postgres data volume the dev stack could not boot. The split-role provisioning (PMS-285) runs both the public-schema and mokosh-auth migration sets as the unprivileged mokosh_migrator role, but two operations in those migrations need privileges a plain BYPASSRLS role lacks. Older dev volumes masked this because their schema + extensions were created earlier by the postgres superuser, pre-split.

Pre-create the four required extensions as the postgres superuser in the entrypoint (uuid-ossp + pg_trgm for the public schema migration 002, citext + pgcrypto for mokosh-auth). They are untrusted, so only a superuser can CREATE them; every migration uses CREATE EXTENSION IF NOT EXISTS so the migration step becomes a no-op. Without this, boot failed at migration 002 with permission denied to create extension "uuid-ossp".

Also GRANT CREATE ON DATABASE to mokosh_migrator so the mokosh-auth bootstrap (which runs as mokosh_migrator via try_bootstrap_sso -> migrator_pool) can CREATE SCHEMA mokosh_auth and own it. Without this, boot failed at mokosh-auth migration 20260506000001 with permission denied for database mokosh.

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

On a fresh Postgres data volume the dev stack could not boot. The split-role provisioning (PMS-285) runs both the public-schema and mokosh-auth migration sets as the unprivileged mokosh_migrator role, but two operations in those migrations need privileges a plain BYPASSRLS role lacks. Older dev volumes masked this because their schema + extensions were created earlier by the postgres superuser, pre-split. Pre-create the four required extensions as the postgres superuser in the entrypoint (uuid-ossp + pg_trgm for the public schema migration 002, citext + pgcrypto for mokosh-auth). They are untrusted, so only a superuser can CREATE them; every migration uses CREATE EXTENSION IF NOT EXISTS so the migration step becomes a no-op. Without this, boot failed at migration 002 with permission denied to create extension "uuid-ossp". Also GRANT CREATE ON DATABASE to mokosh_migrator so the mokosh-auth bootstrap (which runs as mokosh_migrator via try_bootstrap_sso -> migrator_pool) can CREATE SCHEMA mokosh_auth and own it. Without this, boot failed at mokosh-auth migration 20260506000001 with permission denied for database mokosh. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
fix(dev): pre-create pg extensions + grant CREATE-on-db for fresh split-role volume
All checks were successful
Create release / Create release from merged PR (pull_request) Has been skipped
Details
E2E / Playwright against staging (pull_request) Successful in 48s
Details
Check / fmt + clippy + compile + unit/doc tests (pull_request) Successful in 1m15s
Details
Integration / integration tests (pull_request) Successful in 4m27s
Details
32d1b38d9d 
On a fresh Postgres data volume the dev stack could not boot. The split-role provisioning (PMS-285) runs both the public-schema and mokosh-auth migration sets as the unprivileged mokosh_migrator role, but two operations in those migrations need privileges a plain BYPASSRLS role lacks. Older dev volumes masked this because their schema + extensions were created earlier by the postgres superuser, pre-split.

Pre-create the four required extensions as the postgres superuser in the entrypoint (uuid-ossp + pg_trgm for the public schema migration 002, citext + pgcrypto for mokosh-auth). They are untrusted, so only a superuser can CREATE them; every migration uses CREATE EXTENSION IF NOT EXISTS so the migration step becomes a no-op. Without this, boot failed at migration 002 with permission denied to create extension "uuid-ossp".

Also GRANT CREATE ON DATABASE to mokosh_migrator so the mokosh-auth bootstrap (which runs as mokosh_migrator via try_bootstrap_sso -> migrator_pool) can CREATE SCHEMA mokosh_auth and own it. Without this, boot failed at mokosh-auth migration 20260506000001 with permission denied for database mokosh.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
longjacksonle deleted branch fix/dev-pg-preinstall-extensions 2026-06-15 21:46:43 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/mokosh-server!251
No description provided.