hotel-manage-stack/stack-init
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

settings: re-assert DB role password on every deploy, not just first install

Browse source 
Hit in production 2026-08-13: settings crash-looped with 'password
authentication failed' after a routine --only settings redeploy. The
settings Postgres role was only ever created once, in deploy_postgres()'s
init SQL (fresh-volume-only) — so if CREDS_FILE's SETTINGS_DB_PASS ever
drifted from the role's actual password, redeploying settings had no way
to self-heal.

Mirrors the CREATE-then-fallback pattern other apps' deploy functions use,
but falls back to ALTER instead of swallowing the error, since CREATE
failing because the role already exists doesn't fix a drifted password.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
jtricerolph 2026-08-13 12:21:02 +00:00
parent 2088cb5577
commit 68e6c951fd
1 changed files with 22 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

22
install-stack.sh
View file

@ -909,6 +909,28 @@ deploy_settings() {
install_mgmt_key 116
msg_ok "Docker + SSH ready"
# Re-assert the settings DB role/password on every deploy, not just first
# install — the role was originally only created once, in deploy_postgres()'s
# init SQL (fresh-volume-only), so a redeploy had no way to self-heal if
# CREDS_FILE's SETTINGS_DB_PASS ever drifted from the role's actual password
# (hit in production 2026-08-13: settings crash-looped on "password
# authentication failed" after a routine redeploy). CREATE first (covers a
# brand-new postgres where the role doesn't exist yet), ALTER as fallback
# (covers drift on an already-existing role) — CREATE-with-swallowed-error
# alone, as other apps' deploy functions use, can't fix drift.
msg_info "Syncing settings database credentials"
pct exec 100 -- bash -c "
docker exec hotel-manage-postgres psql -U postgres -c \
\"CREATE USER settings WITH PASSWORD '${SETTINGS_DB_PASS}';\" 2>/dev/null || \
docker exec hotel-manage-postgres psql -U postgres -c \
\"ALTER USER settings WITH PASSWORD '${SETTINGS_DB_PASS}';\"
docker exec hotel-manage-postgres psql -U postgres -c \
\"CREATE DATABASE settings_db OWNER settings;\" 2>/dev/null || true
docker exec hotel-manage-postgres psql -U postgres -d settings_db -c \
\"GRANT ALL ON SCHEMA public TO settings;\" 2>/dev/null || true
" &>/dev/null
msg_ok "Database settings_db ready"
# Copy the shared deploy SSH key so settings can SSH into the MQTT broker
# LXC (104) to manage dynamic-security clients — same mechanism management
# uses for its Shell/exec tab, just consumed by a second container.