provision

func AllDatabases ¶ added in v0.2.0

func AllDatabases(c *registry.Config) ([]string, error)

AllDatabases lists every non-template database in the cluster, which is the only way to see what is there that the registry does not know about.

func CreateTenant ¶

func CreateTenant(c *registry.Config, p registry.Project, db string) error

CreateTenant makes a tenant database owned by the project's role, from template1 so it inherits both the pgbouncer auth hook and the isolation guard -- exactly as one created by the application at runtime would.

func Databases ¶

func Databases(c *registry.Config, p registry.Project) ([]string, error)

Databases returns the control database plus every tenant database sharing the project's prefix, which together are everything the project owns.

func DropDatabases ¶

func DropDatabases(c *registry.Config, p registry.Project) ([]string, error)

DropDatabases removes every database the project owns. FORCE terminates live backends -- without it a single idle psql session blocks the drop.

func DropOne ¶

func DropOne(c *registry.Config, db string) error

DropOne drops a single database. FORCE terminates live backends, including pgbouncer's idle pooled server connections, which otherwise block the drop.

func DropRole ¶

func DropRole(c *registry.Config, p registry.Project) error

func EnsureDB ¶

func EnsureDB(c *registry.Config, p registry.Project) error

EnsureDB creates the control database from template1 -- which is what makes it inherit the pgbouncer auth hook -- then locks it down.

On a shared cluster the default (PUBLIC may CONNECT) would let every project role read every other project's data. Revoking it is the main thing standing between "one convenient cluster" and "one shared blast radius".

func EnsureRole ¶

func EnsureRole(c *registry.Config, p registry.Project) error

EnsureRole makes the login role idempotently and syncs its password and CREATEDB bit. CREATEDB is what lets a multi-tenant app create tenant databases at runtime; without Tenants set the role explicitly loses it.

func Harden ¶

func Harden(c *registry.Config, p registry.Project) error

Harden re-applies connect privileges to the control database and every tenant database under the project's prefix. Tenant databases are created by the application at runtime, so dragonrun only ever sees them after the fact.

func Psql ¶

func Psql(c *registry.Config, p registry.Project, db string) error

Psql attaches an interactive shell to a database as the project's own role, via pgbouncer, so what you type is subject to the same privileges the app has.

func Tenants ¶

func Tenants(c *registry.Config, p registry.Project) ([]string, error)

Tenants is Databases minus the control database.