Skip to content

Commit 4da3ff9

Browse files
jfrochesamrose
jfroche
authored and
samrose
committed
feat: multiple versions for the vault extension
Build multiple versions of the vault extension on different PostgreSQL versions. Add test for the extensions and their upgrade on PostgreSQL 15 and 17.
1 parent 8ac1c90 commit 4da3ff9

File tree

7 files changed

+342
-31
lines changed

7 files changed

+342
-31
lines changed

‎nix/ext/tests/default.nix‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -69,12 +69,20 @@ let
6969
enable = true;
7070
package = psql_15;
7171
enableTCPIP = true;
72-
initialScript = pkgs.writeText "init-postgres-with-password" ''
73-
CREATE USER test WITH PASSWORD 'secret';
74-
'';
7572
authentication = ''
76-
host test postgres samenet scram-sha-256
73+
local all postgres peer map=postgres
74+
local all all peer map=root
75+
'';
76+
identMap = ''
77+
root root supabase_admin
78+
postgres postgres postgres
7779
'';
80+
ensureUsers = [
81+
{
82+
name = "supabase_admin";
83+
ensureClauses.superuser = true;
84+
}
85+
];
7886
settings = (installedExtension "15").defaultSettings or { };
7987
};
8088

‎nix/ext/tests/lib.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,12 +38,12 @@ def __init__(
3838

3939
def run_sql(self, query: str) -> str:
4040
return self.vm.succeed(
41-
f"""sudo -u postgres psql -t -A -F\",\" -c \"{query}\" """
41+
f"""psql -U supabase_admin -d postgres -t -A -F\",\" -c \"{query}\" """
4242
).strip()
4343

4444
def run_sql_file(self, file: str) -> str:
4545
return self.vm.succeed(
46-
f"""sudo -u postgres psql -v ON_ERROR_STOP=1 -f \"{file}\""""
46+
f"""psql -U supabase_admin -d postgres -v ON_ERROR_STOP=1 -f \"{file}\""""
4747
).strip()
4848

4949
def drop_extension(self):

‎nix/ext/tests/pgmq.nix‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,20 @@ self.inputs.nixpkgs.lib.nixos.runTest {
4747
services.postgresql = {
4848
enable = true;
4949
package = (postgresqlWithExtension psql_15);
50+
authentication = ''
51+
local all postgres peer map=postgres
52+
local all all peer map=root
53+
'';
54+
identMap = ''
55+
root root supabase_admin
56+
postgres postgres postgres
57+
'';
58+
ensureUsers = [
59+
{
60+
name = "supabase_admin";
61+
ensureClauses.superuser = true;
62+
}
63+
];
5064
settings = (installedExtension "15").defaultSettings or { };
5165
};
5266

‎nix/ext/tests/timescaledb.nix‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,22 @@ self.inputs.nixpkgs.lib.nixos.runTest {
4646
services.postgresql = {
4747
enable = true;
4848
package = (postgresqlWithExtension psql_15);
49+
authentication = ''
50+
local all postgres peer map=postgres
51+
local all all peer map=root
52+
'';
53+
identMap = ''
54+
root root supabase_admin
55+
postgres postgres postgres
56+
'';
57+
ensureUsers = [
58+
{
59+
name = "supabase_admin";
60+
ensureClauses.superuser = true;
61+
}
62+
{ name = "service_role"; }
63+
];
64+
4965
settings = {
5066
shared_preload_libraries = "timescaledb";
5167
};

‎nix/ext/tests/vault.nix‎

Lines changed: 200 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,200 @@
1+
{ self, pkgs }:
2+
let
3+
pname = "supabase_vault";
4+
inherit (pkgs) lib;
5+
installedExtension =
6+
postgresMajorVersion: self.packages.${pkgs.system}."psql_${postgresMajorVersion}/exts/${pname}-all";
7+
versions = postgresqlMajorVersion: (installedExtension postgresqlMajorVersion).versions;
8+
postgresqlWithExtension =
9+
postgresql:
10+
let
11+
majorVersion = lib.versions.major postgresql.version;
12+
pkg = pkgs.buildEnv {
13+
name = "postgresql-${majorVersion}-${pname}";
14+
paths = [
15+
postgresql
16+
postgresql.lib
17+
(installedExtension majorVersion)
18+
self.packages.${pkgs.system}."psql_${majorVersion}/exts/pgsodium-all" # dependency
19+
];
20+
passthru = {
21+
inherit (postgresql) version psqlSchema;
22+
lib = pkg;
23+
withPackages = _: pkg;
24+
};
25+
nativeBuildInputs = [ pkgs.makeWrapper ];
26+
pathsToLink = [
27+
"/"
28+
"/bin"
29+
"/lib"
30+
];
31+
postBuild = ''
32+
wrapProgram $out/bin/postgres --set NIX_PGLIBDIR $out/lib
33+
wrapProgram $out/bin/pg_ctl --set NIX_PGLIBDIR $out/lib
34+
wrapProgram $out/bin/pg_upgrade --set NIX_PGLIBDIR $out/lib
35+
'';
36+
};
37+
in
38+
pkg;
39+
vaultGetKey = lib.getExe (
40+
pkgs.writeShellScriptBin "vault-getkey" ''
41+
echo 0000000000000000000000000000000000000000000000000000000000000000
42+
''
43+
);
44+
psql_15 = postgresqlWithExtension self.packages.${pkgs.system}.postgresql_15;
45+
psql_17 = postgresqlWithExtension self.packages.${pkgs.system}.postgresql_17;
46+
in
47+
self.inputs.nixpkgs.lib.nixos.runTest {
48+
name = pname;
49+
hostPkgs = pkgs;
50+
nodes.server =
51+
{ config, ... }:
52+
{
53+
virtualisation = {
54+
forwardPorts = [
55+
{
56+
from = "host";
57+
host.port = 13022;
58+
guest.port = 22;
59+
}
60+
];
61+
};
62+
63+
services.postgresql = {
64+
enable = true;
65+
package = psql_15;
66+
authentication = ''
67+
local all postgres peer map=postgres
68+
local all all peer map=root
69+
'';
70+
identMap = ''
71+
root root supabase_admin
72+
postgres postgres postgres
73+
'';
74+
initialScript = pkgs.writeText "vault-init.sql" ''
75+
CREATE SCHEMA vault;
76+
'';
77+
ensureUsers = [
78+
{
79+
name = "supabase_admin";
80+
ensureClauses.superuser = true;
81+
}
82+
{ name = "service_role"; }
83+
];
84+
settings = {
85+
"shared_preload_libraries" = "${pname},pgsodium";
86+
"pgsodium.getkey_script" = vaultGetKey;
87+
"vault.getkey_script" = vaultGetKey;
88+
};
89+
};
90+
91+
specialisation.postgresql17.configuration = {
92+
services.postgresql = {
93+
package = lib.mkForce psql_17;
94+
};
95+
96+
systemd.services.postgresql-migrate = {
97+
serviceConfig = {
98+
Type = "oneshot";
99+
RemainAfterExit = true;
100+
User = "postgres";
101+
Group = "postgres";
102+
StateDirectory = "postgresql";
103+
WorkingDirectory = "${builtins.dirOf config.services.postgresql.dataDir}";
104+
};
105+
script =
106+
let
107+
oldPostgresql = psql_15;
108+
newPostgresql = psql_17;
109+
oldDataDir = "${builtins.dirOf config.services.postgresql.dataDir}/${oldPostgresql.psqlSchema}";
110+
newDataDir = "${builtins.dirOf config.services.postgresql.dataDir}/${newPostgresql.psqlSchema}";
111+
in
112+
''
113+
if [[ ! -d ${newDataDir} ]]; then
114+
install -d -m 0700 -o postgres -g postgres "${newDataDir}"
115+
${newPostgresql}/bin/initdb -D "${newDataDir}"
116+
echo "shared_preload_libraries = '${pname},pgsodium'" >> "${newDataDir}/postgresql.conf"
117+
echo "vault.getkey_script = '${vaultGetKey}'" >> "${newDataDir}/postgresql.conf";
118+
echo "pgsodium.getkey_script = '${vaultGetKey}'" >> "${newDataDir}/postgresql.conf";
119+
${newPostgresql}/bin/pg_upgrade --old-datadir "${oldDataDir}" --new-datadir "${newDataDir}" \
120+
--old-bindir "${oldPostgresql}/bin" --new-bindir "${newPostgresql}/bin"
121+
else
122+
echo "${newDataDir} already exists"
123+
fi
124+
'';
125+
};
126+
127+
systemd.services.postgresql = {
128+
after = [ "postgresql-migrate.service" ];
129+
requires = [ "postgresql-migrate.service" ];
130+
};
131+
};
132+
};
133+
testScript =
134+
{ nodes, ... }:
135+
let
136+
pg17-configuration = "${nodes.server.system.build.toplevel}/specialisation/postgresql17";
137+
in
138+
''
139+
from pathlib import Path
140+
versions = {
141+
"15": [${lib.concatStringsSep ", " (map (s: ''"${s}"'') (versions "15"))}],
142+
"17": [${lib.concatStringsSep ", " (map (s: ''"${s}"'') (versions "17"))}],
143+
}
144+
extension_name = "${pname}"
145+
support_upgrade = True
146+
pg17_configuration = "${pg17-configuration}"
147+
ext_has_background_worker = ${
148+
if (installedExtension "15") ? hasBackgroundWorker then "True" else "False"
149+
}
150+
sql_test_directory = Path("${../../tests}")
151+
pg_regress_test_name = "${(installedExtension "15").pgRegressTestName or pname}"
152+
153+
${builtins.readFile ./lib.py}
154+
155+
start_all()
156+
157+
server.wait_for_unit("multi-user.target")
158+
server.wait_for_unit("postgresql.service")
159+
160+
test = PostgresExtensionTest(server, extension_name, versions, sql_test_directory, support_upgrade)
161+
162+
163+
with subtest("Check upgrade path with postgresql 15"):
164+
test.check_upgrade_path("15")
165+
166+
with subtest("Check pg_regress with postgresql 15 after extension upgrade"):
167+
test.run_sql_file("${../../../ansible/files/postgresql_extension_custom_scripts/supabase_vault/after-create.sql}")
168+
test.check_pg_regress(Path("${psql_15}/lib/pgxs/src/test/regress/pg_regress"), "15", pg_regress_test_name)
169+
170+
last_version = None
171+
with subtest("Check the install of the last version of the extension"):
172+
last_version = test.check_install_last_version("15")
173+
174+
with subtest("Check pg_regress with postgresql 15 after installing the last version"):
175+
test.run_sql_file("${../../../ansible/files/postgresql_extension_custom_scripts/supabase_vault/after-create.sql}")
176+
test.check_pg_regress(Path("${psql_15}/lib/pgxs/src/test/regress/pg_regress"), "15", pg_regress_test_name)
177+
178+
with subtest("switch to postgresql 17"):
179+
server.succeed(
180+
f"{pg17_configuration}/bin/switch-to-configuration test >&2"
181+
)
182+
183+
with subtest("Check last version of the extension after postgresql upgrade"):
184+
test.assert_version_matches(last_version)
185+
186+
with subtest("Check upgrade path with postgresql 17"):
187+
test.check_upgrade_path("17")
188+
189+
with subtest("Check pg_regress with postgresql 17 after extension upgrade"):
190+
test.run_sql_file("${../../../ansible/files/postgresql_extension_custom_scripts/supabase_vault/after-create.sql}")
191+
test.check_pg_regress(Path("${psql_17}/lib/pgxs/src/test/regress/pg_regress"), "17", pg_regress_test_name)
192+
193+
with subtest("Check the install of the last version of the extension"):
194+
test.check_install_last_version("17")
195+
196+
with subtest("Check pg_regress with postgresql 17 after installing the last version"):
197+
test.run_sql_file("${../../../ansible/files/postgresql_extension_custom_scripts/supabase_vault/after-create.sql}")
198+
test.check_pg_regress(Path("${psql_17}/lib/pgxs/src/test/regress/pg_regress"), "17", pg_regress_test_name)
199+
'';
200+
}

0 commit comments

Comments
 (0)