Persistent PostgreSQL sandbox deployment

2026-10-20 16:02:18 -04:00
parent 84a505c4a5
commit 4cac26d84b
14 changed files with 333 additions and 1 deletions
@@ -0,0 +1,30 @@
+import { Pool } from 'pg';
+import { postgresConfig } from '../server/market/postgres-config.ts';
+import { migrateCustody, grantCustodyRuntime } from '../server/market/postgres-schema.ts';
+import { IS_MAINNET } from '../shared/network.ts';
+
+// Explicit one-shot service in the local persistent sandbox stack, NOT HTTP-startup migrations.
+if (IS_MAINNET || process.env.WIKIDECK_LOCAL_PG_BOOTSTRAP !== 'sandbox-only') throw new Error('Local sandbox bootstrap only');
+const ca = '/secrets/admin/ca.crt';
+const config = (role: string) => postgresConfig({ WIKIDECK_CUSTODY_PG_URL_FILE: `/secrets/${role}/url`, WIKIDECK_CUSTODY_PG_CA_FILE: ca });
+try {
+  const admin = new Pool(await config('admin'));
+  try {
+    const ownerConfig = await config('owner'), runtimeConfig = await config('runtime');
+    for (const [role, password] of [['custody_owner', ownerConfig.password], ['custody_runtime', runtimeConfig.password]] as const) {
+      // Static role allowlist; password is a generated hex token. Values are never printed, even on error.
+      if (typeof password !== 'string' || !/^[a-f0-9]{64}$/.test(password)) throw new Error('Invalid generated credential');
+      const exists = await admin.query('SELECT 1 FROM pg_roles WHERE rolname=$1', [role]);
+      if (!exists.rowCount) await admin.query(`CREATE ROLE ${role} LOGIN PASSWORD '${password}' NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS`);
+    }
+    await admin.query('REVOKE CREATE ON SCHEMA public FROM PUBLIC; REVOKE ALL ON DATABASE wikideck_custody FROM PUBLIC');
+    await admin.query('GRANT CONNECT,CREATE ON DATABASE wikideck_custody TO custody_owner; GRANT CONNECT ON DATABASE wikideck_custody TO custody_runtime');
+  } finally { await admin.end(); }
+  const owner = new Pool(await config('owner'));
+  try { await migrateCustody(owner); await grantCustodyRuntime(owner, 'custody_runtime'); }
+  finally { await owner.end(); }
+  console.log('Local PostgreSQL schema and restricted runtime grants ready. Sandbox payments only.');
+} catch {
+  console.error('Local PostgreSQL bootstrap failed; inspect roles, secret volumes, TLS and schema privately. No reset or fallback performed.');
+  process.exitCode = 1;
+}