The moments cert_cn → role mappings in pg_ident.conf.d/ were written to per-host files (<cert_cn host>.conf), shared with other apps' mappings for the same hosts (e.g. nikola.kosherinata.internal.conf carried both mm and moments_ro). Any other app's provisioning that rewrites its host file can clobber or drop moments access.
This also bit in practice: when the worker moved from roosta to frootmig, no frootmig...conf mapping was created, and the worker crash-looped with no match in usermap "cert_cn" (masked until the frootmig host cert expiry was fixed on 2026-07-02).
Fix:
script/db-perms.sh maintains a single app-owned pg_ident.conf.d/moments.conf and migrates any moments_ro/moments_rw lines out of legacy host-named files (verbatim, so workstation mappings survive), deleting legacy files left empty.
correct the standby hostname (frankie.kosherinata.internal → frankie.hanzalova.internal; the old name no longer resolves) and warn-and-continue on unreachable pg hosts instead of aborting.
asset/postgres/ident.conf.tmpl documents the new convention.
Applied to magrathea (primary) on 2026-07-02; frankie (standby) is tracked separately.
The moments cert_cn → role mappings in `pg_ident.conf.d/` were written to per-host files (`<cert_cn host>.conf`), shared with other apps' mappings for the same hosts (e.g. `nikola.kosherinata.internal.conf` carried both `mm` and `moments_ro`). Any other app's provisioning that rewrites its host file can clobber or drop moments access.
This also bit in practice: when the worker moved from roosta to frootmig, no `frootmig...conf` mapping was created, and the worker crash-looped with `no match in usermap "cert_cn"` (masked until the frootmig host cert expiry was fixed on 2026-07-02).
Fix:
- `script/db-perms.sh` maintains a single app-owned `pg_ident.conf.d/moments.conf` and migrates any `moments_ro`/`moments_rw` lines out of legacy host-named files (verbatim, so workstation mappings survive), deleting legacy files left empty.
- correct the standby hostname (`frankie.kosherinata.internal` → `frankie.hanzalova.internal`; the old name no longer resolves) and warn-and-continue on unreachable pg hosts instead of aborting.
- `asset/postgres/ident.conf.tmpl` documents the new convention.
Applied to magrathea (primary) on 2026-07-02; frankie (standby) is tracked separately.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
The moments cert_cn → role mappings in
pg_ident.conf.d/were written to per-host files (<cert_cn host>.conf), shared with other apps' mappings for the same hosts (e.g.nikola.kosherinata.internal.confcarried bothmmandmoments_ro). Any other app's provisioning that rewrites its host file can clobber or drop moments access.This also bit in practice: when the worker moved from roosta to frootmig, no
frootmig...confmapping was created, and the worker crash-looped withno match in usermap "cert_cn"(masked until the frootmig host cert expiry was fixed on 2026-07-02).Fix:
script/db-perms.shmaintains a single app-ownedpg_ident.conf.d/moments.confand migrates anymoments_ro/moments_rwlines out of legacy host-named files (verbatim, so workstation mappings survive), deleting legacy files left empty.frankie.kosherinata.internal→frankie.hanzalova.internal; the old name no longer resolves) and warn-and-continue on unreachable pg hosts instead of aborting.asset/postgres/ident.conf.tmpldocuments the new convention.Applied to magrathea (primary) on 2026-07-02; frankie (standby) is tracked separately.