2 Commits

Author	SHA1	Message	Date
rob thijssen	3d7cbd90d6	fix(infra): own pg_ident mappings in an app-specific moments.conf ... Write the cert_cn -> role mappings to pg_ident.conf.d/moments.conf instead of per-host <cert_cn>.conf files, so provisioning for other apps that own drop-ins for the same hosts can never clobber or drop moments access. db-perms.sh now also migrates any moments_ro/rw lines found in legacy host-named files into moments.conf verbatim (deleting legacy files left empty), corrects the standby hostname to frankie.hanzalova.internal, and warns-and-continues on an unreachable pg host instead of aborting the run. Closes #3 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dcsi987fK5ftZEP6w3HXEd	2026-07-02 09:29:00 +03:00
rob thijssen	e40d6b0e44	chore(asset): add postgres bootstrap and pg_ident template ... Idempotent SQL for role and database creation, split between the postgres-database scope (bootstrap.sql) and the moments-database scope (bootstrap-moments.sql), since CREATE DATABASE can't run inside a DO block or transaction. Roles: moments_rw — owner of the moments database; runs migrations and writes events from moments-worker. moments_ro — read-only; consumed by moments-api. The pg_ident template is rendered per-host by deploy.sh once it lands; one (host, role) mapping per file. Reload required on both magrathea and frankie after install — pg_ident is not replicated. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-03 17:52:35 +03:00