Lock down the repmgr user (#222)

* Lock down the repmgr user * Add PGPASSFILE to timescale dockerfile
fly-apps · Mar 15, 2024 · 41b6aba · 41b6aba
1 parent 396d2fd
commit 41b6aba
Show file tree

Hide file tree

Showing 4 changed files with 6 additions and 2 deletions.
diff --git a/Dockerfile b/Dockerfile
@@ -19,6 +19,7 @@ COPY ./bin/* /fly/bin/
 FROM wrouesnel/postgres_exporter:latest AS postgres_exporter
 FROM postgres:${PG_VERSION}
 ENV PGDATA=/data/postgresql
+ENV PGPASSFILE=/data/.pgpass
 ARG VERSION
 ARG PG_MAJOR_VERSION
 ARG POSTGIS_MAJOR=3

diff --git a/Dockerfile-timescaledb b/Dockerfile-timescaledb
@@ -20,6 +20,7 @@ FROM wrouesnel/postgres_exporter:latest AS postgres_exporter
 
 FROM postgres:${PG_VERSION}
 ENV PGDATA=/data/postgresql
+ENV PGPASSFILE=/data/.pgpass
 ARG VERSION
 ARG PG_MAJOR_VERSION
 ARG POSTGIS_MAJOR=3

diff --git a/internal/flypg/pg.go b/internal/flypg/pg.go
@@ -471,14 +471,14 @@ func (c *PGConfig) setDefaultHBA() error {
 			Database: "replication",
 			User:     c.repmgrUsername,
 			Address:  "fdaa::/16",
-			Method:   "trust",
+			Method:   "md5",
 		},
 		{
 			Type:     "host",
 			Database: fmt.Sprintf("replication,%s", c.repmgrDatabase),
 			User:     c.repmgrUsername,
 			Address:  "fdaa::/16",
-			Method:   "trust",
+			Method:   "md5",
 		},
 		{
 			Type:     "host",

diff --git a/internal/flypg/repmgr.go b/internal/flypg/repmgr.go
@@ -124,6 +124,7 @@ func (r *RepMgr) initialize() error {
 	if err := os.WriteFile(r.PasswordConfigPath, []byte(passStr), 0600); err != nil {
 		return fmt.Errorf("failed to write file %s: %s", r.PasswordConfigPath, err)
 	}
+
 	if err := utils.SetFileOwnership(r.PasswordConfigPath, "postgres"); err != nil {
 		return fmt.Errorf("failed to set file ownership: %s", err)
 	}
@@ -178,6 +179,7 @@ func (r *RepMgr) setDefaults() error {
 		"priority":                     100,
 		"node_rejoin_timeout":          30,
 		"standby_reconnect_timeout":    30,
+		"passfile":                     fmt.Sprintf("'%s'", r.PasswordConfigPath),
 	}
 
 	if !r.eligiblePrimary() {