dev/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

nixos/postgresql: enable private /tmp & private mounts; fix wal-receiver test

Browse Source 
The issue was that the old test-case used `/tmp` to share data. Using
`JoinsNamespaceOf=` wasn't a real workaround since the private `/tmp` is
recreated when a service gets stopped/started which is the case here, so
the wals were still lost.

To keep the test building with `PrivateTmp=yes`, create a dedicated
directory in `/var/cache` with tmpfiles and allow the hardened
`postgresql.service` to access it via `ReadWritePaths`.
This commit is contained in:
Maximilian Bosch 2024-09-30 17:23:10 +02:00 committed by Martin Weinelt
parent 2ebffcc4c7
commit f800d8e42b
No known key found for this signature in database
GPG Key ID: 87C1E9888F856759
2 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
nixos/modules/services/databases/postgresql.nix
View File

@ -627,14 +627,14 @@ in
# Hardening
CapabilityBoundingSet = [ "" ];
DevicePolicy = "closed";
PrivateTmp = false; #breaks wal-receiver test
PrivateTmp = true;
ProtectHome = true;
ProtectSystem = "strict";
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
LockPersonality = true;
PrivateDevices = true;
PrivateMounts = false; # breaks wal-receiver test
PrivateMounts = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;

9
nixos/tests/postgresql-wal-receiver.nix
View File

@ -22,8 +22,8 @@ let
replicationUser = "wal_receiver_user";
replicationSlot = "wal_receiver_slot";
replicationConn = "postgresql://${replicationUser}@localhost";
baseBackupDir = "/tmp/pg_basebackup";
walBackupDir = "/tmp/pg_wal";
baseBackupDir = "/var/cache/wals/pg_basebackup";
walBackupDir = "/var/cache/wals/pg_wal";
recoveryFile = pkgs.writeTextDir "recovery.signal" "";
@ -32,6 +32,10 @@ let
meta.maintainers = with lib.maintainers; [ pacien ];
nodes.machine = { ... }: {
systemd.tmpfiles.rules = [
"d /var/cache/wals 0750 postgres postgres - -"
];
services.postgresql = {
package = pkg;
enable = true;
@ -60,6 +64,7 @@ let
# This is only to speedup test, it isn't time racing. Service is set to autorestart always,
# default 60sec is fine for real system, but is too much for a test
systemd.services.postgresql-wal-receiver-main.serviceConfig.RestartSec = lib.mkForce 5;
systemd.services.postgresql.serviceConfig.ReadWritePaths = [ "/var/cache/wals" ];
};
testScript = ''