movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-14 06:00:33 +03:00
Code Activity

Merge: nixos/postgresql: set up sandboxing (#344925)

Browse source
This commit is contained in:
Maximilian Bosch 2024-11-02 11:12:15 +01:00 • committed by GitHub
commit 500d745e73
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
5 changed files with 71 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
nixos/tests/postgresql-wal-receiver.nix
View file

@ -22,8 +22,8 @@ let
replicationUser = "wal_receiver_user";
replicationSlot = "wal_receiver_slot";
replicationConn = "postgresql://${replicationUser}@localhost";
baseBackupDir = "/tmp/pg_basebackup";
walBackupDir = "/tmp/pg_wal";
baseBackupDir = "/var/cache/wals/pg_basebackup";
walBackupDir = "/var/cache/wals/pg_wal";
recoveryFile = pkgs.writeTextDir "recovery.signal" "";
@ -32,6 +32,10 @@ let
meta.maintainers = with lib.maintainers; [ pacien ];
nodes.machine = { ... }: {
systemd.tmpfiles.rules = [
"d /var/cache/wals 0750 postgres postgres - -"
];
services.postgresql = {
package = pkg;
enable = true;
@ -60,6 +64,7 @@ let
# This is only to speedup test, it isn't time racing. Service is set to autorestart always,
# default 60sec is fine for real system, but is too much for a test
systemd.services.postgresql-wal-receiver-main.serviceConfig.RestartSec = lib.mkForce 5;
systemd.services.postgresql.serviceConfig.ReadWritePaths = [ "/var/cache/wals" ];
};
testScript = ''

2
nixos/tests/postgresql.nix
View file

@ -126,6 +126,8 @@ let
with subtest("Initdb works"):
machine.succeed("sudo -u postgres initdb -D /tmp/testpostgres2")
machine.log(machine.execute("systemd-analyze security postgresql.service | grep -v ✓")[1])
machine.shutdown()
'';