tmp

Author: soedirgo

ansible/files/sodium_extension.sql

@@ -8,8 +8,8 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.0.1.021-orioledb-vault-1"
-  postgres15: "15.8.1.031-vault-1"
+  postgresorioledb-17: "17.0.1.021-orioledb-vault-3"
+  postgres15: "15.8.1.031-vault-3"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"

ansible/vars.yml

@@ -0,0 +1,17 @@
+-- migrate:up
+
+DO $$
+BEGIN
+  IF EXISTS (select from pg_available_extensions where name = 'supabase_vault')
+  THEN
+    create extension if not exists supabase_vault;
+
+    -- for some reason extension custom scripts aren't run during AMI build, so
+    -- we manually run it here
+    grant usage on schema vault to postgres with grant option;
+    grant select on vault.secrets, vault.decrypted_secrets to postgres with grant option;
+    grant execute on function vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt to postgres with grant option;
+  END IF;
+END $$;
+
+-- migrate:down

migrations/db/migrations/20221207154255_create_pgsodium_and_vault.sql

@@ -4,7 +4,5 @@ ALTER ROLE authenticated inherit;
 ALTER ROLE anon inherit;
 ALTER ROLE service_role inherit;
 
-GRANT pgsodium_keyholder to service_role;
-
 -- migrate:down