rob thijssen
3d7cbd90d6
Some checks failed
deploy / Build prerendered web (push) Successful in 6m59s
deploy / Build api + worker (static musl) (push) Failing after 11m22s
deploy / Deploy web to oolon (push) Successful in 28s
deploy / Deploy moments-api to nikola (push) Has been skipped
deploy / Deploy moments-worker to frootmig (push) Has been skipped
refresh / Rebuild prerendered web (push) Successful in 6m49s
refresh / Deploy refreshed web to oolon (push) Successful in 19s
Write the cert_cn -> role mappings to pg_ident.conf.d/moments.conf instead of per-host <cert_cn>.conf files, so provisioning for other apps that own drop-ins for the same hosts can never clobber or drop moments access. db-perms.sh now also migrates any moments_ro/rw lines found in legacy host-named files into moments.conf verbatim (deleting legacy files left empty), corrects the standby hostname to frankie.hanzalova.internal, and warns-and-continues on an unreachable pg host instead of aborting the run. Closes #3 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dcsi987fK5ftZEP6w3HXEd
17 lines
745 B
Cheetah
17 lines
745 B
Cheetah
# moments — pg_ident.conf.d drop-in template
|
|
# Maintained by script/db-perms.sh (idempotent; run from a workstation).
|
|
# Install path: /var/lib/pgsql/18/data/pg_ident.conf.d/moments.conf
|
|
#
|
|
# The file is named for the app (moments.conf), NOT the cert_cn host, so
|
|
# provisioning for other apps — which may own drop-ins for the same hosts —
|
|
# can never clobber or interleave with moments access.
|
|
#
|
|
# Apply with: sudo systemctl reload postgresql-18 — on BOTH magrathea
|
|
# (primary) and frankie (standby) so failover doesn't lock the app out.
|
|
#
|
|
# One line per (cert_cn host, role) mapping. A host that runs both
|
|
# moments-api and moments-worker will have two lines (one for moments_ro,
|
|
# one for moments_rw).
|
|
|
|
cert_cn {{HOST_FQDN}} {{DB_ROLE}}
|