From 9066c2572950024f00a1465383bf5b0aa0fe1f90 Mon Sep 17 00:00:00 2001 From: dadachann <185672915+dadachann@users.noreply.github.com> Date: Thu, 30 Jul 2026 14:58:31 +0000 Subject: [PATCH] fix(deploy): let migration own exact runtime ACLs --- deploy/prod/deploy.sh | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/deploy/prod/deploy.sh b/deploy/prod/deploy.sh index 792b2d63b..f434a7403 100755 --- a/deploy/prod/deploy.sh +++ b/deploy/prod/deploy.sh @@ -71,19 +71,15 @@ WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'langbot_runtime')\gexe ALTER ROLE langbot_runtime PASSWORD :'runtime_password'; GRANT CONNECT ON DATABASE langbot TO langbot_runtime; REVOKE CREATE ON SCHEMA public FROM PUBLIC, langbot_runtime; +REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA public FROM langbot_runtime; +REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public FROM langbot_runtime; +ALTER DEFAULT PRIVILEGES FOR ROLE langbot_operator IN SCHEMA public REVOKE ALL ON TABLES FROM langbot_runtime; +ALTER DEFAULT PRIVILEGES FOR ROLE langbot_operator IN SCHEMA public REVOKE ALL ON SEQUENCES FROM langbot_runtime; GRANT USAGE ON SCHEMA public TO langbot_runtime; SQL docker compose --profile tools run --rm migrate -docker compose exec -T postgres psql -v ON_ERROR_STOP=1 -U langbot_operator -d langbot <<'SQL' -GRANT USAGE ON SCHEMA public TO langbot_runtime; -GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO langbot_runtime; -GRANT USAGE, SELECT, UPDATE ON ALL SEQUENCES IN SCHEMA public TO langbot_runtime; -ALTER DEFAULT PRIVILEGES FOR ROLE langbot_operator IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO langbot_runtime; -ALTER DEFAULT PRIVILEGES FOR ROLE langbot_operator IN SCHEMA public GRANT USAGE, SELECT, UPDATE ON SEQUENCES TO langbot_runtime; -SQL - docker compose up -d --remove-orphans plugin-runtime core for _ in $(seq 1 90); do if docker compose exec -T core python -c 'import urllib.request; urllib.request.urlopen("http://127.0.0.1:5300/healthz", timeout=3)' >/dev/null 2>&1; then