mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-15 13:02:04 +01:00
ryan4yin | 二花
3694961e74
* fix(postgres): require a password for superuser over TCP * test: assert the postgres loopback auth rules * fix(darwin): keep root-only agenix secrets root-only * docs(security): record the local auth boundaries and retire WA-015
68 lines
1.3 KiB
Nix
68 lines
1.3 KiB
Nix
{
|
|
lib,
|
|
outputs,
|
|
}:
|
|
let
|
|
cfg = outputs.nixosConfigurations.youko.config;
|
|
auth = cfg.services.postgresql.authentication;
|
|
lines = lib.splitString "\n" auth;
|
|
fields = line: builtins.filter (s: s != "") (lib.splitString " " line);
|
|
hasLine = want: builtins.any (line: fields line == want) lines;
|
|
indexOf =
|
|
want:
|
|
let
|
|
go =
|
|
i: xs:
|
|
if xs == [ ] then
|
|
null
|
|
else if fields (builtins.head xs) == want then
|
|
i
|
|
else
|
|
go (i + 1) (builtins.tail xs);
|
|
in
|
|
go 0 lines;
|
|
in
|
|
lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
|
|
name:
|
|
if name != "youko" then
|
|
true
|
|
else
|
|
# The superuser and replication rows must require a password, and the
|
|
# postgres row must precede the generic loopback trust row (first match wins).
|
|
hasLine [
|
|
"host"
|
|
"all"
|
|
"postgres"
|
|
"127.0.0.1/32"
|
|
"scram-sha-256"
|
|
]
|
|
&& hasLine [
|
|
"host"
|
|
"replication"
|
|
"all"
|
|
"127.0.0.1/32"
|
|
"scram-sha-256"
|
|
]
|
|
&& hasLine [
|
|
"host"
|
|
"all"
|
|
"all"
|
|
"127.0.0.1/32"
|
|
"trust"
|
|
]
|
|
&&
|
|
indexOf [
|
|
"host"
|
|
"all"
|
|
"postgres"
|
|
"127.0.0.1/32"
|
|
"scram-sha-256"
|
|
] < indexOf [
|
|
"host"
|
|
"all"
|
|
"all"
|
|
"127.0.0.1/32"
|
|
"trust"
|
|
]
|
|
)
|