From b4fa188f4c8d173fb891d68c68f8b39449ce465e Mon Sep 17 00:00:00 2001 From: Noah Moss Date: Thu, 24 Sep 2026 14:52:22 -0400 Subject: [PATCH 1/5] add ansible/files/commence-restore.service.j2 --- ansible/files/commence-restore.service.j2 | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 ansible/files/commence-restore.service.j2 diff --git a/ansible/files/commence-restore.service.j2 b/ansible/files/commence-restore.service.j2 new file mode 100644 index 0000000000..804aa906d2 --- /dev/null +++ b/ansible/files/commence-restore.service.j2 @@ -0,0 +1,10 @@ +[Unit] +Description=Async commence restore of physical backup + +[Service] +Type=notify +TimeoutStartSec=30 +User=adminapi +ExecStart=/usr/bin/admin-mgr commence-restore --run-as-service true +Restart=no +OOMScoreAdjust=-1000 From 6249795223a94ed204282f5d4d199f45db66f6c2 Mon Sep 17 00:00:00 2001 From: Noah Moss Date: Thu, 24 Sep 2026 14:59:06 -0400 Subject: [PATCH 2/5] add ansible task for creating service file --- ansible/tasks/internal/admin-api.yml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/ansible/tasks/internal/admin-api.yml b/ansible/tasks/internal/admin-api.yml index be1673a5b6..f7a594071a 100644 --- a/ansible/tasks/internal/admin-api.yml +++ b/ansible/tasks/internal/admin-api.yml @@ -81,8 +81,13 @@ - name: adminapi - create service file for commence backup process template: - src: files/commence-backup.service.j2 - dest: /etc/systemd/system/commence-backup.service + src: files/commence-backup.service.j2 + dest: /etc/systemd/system/commence-backup.service + +- name: adminapi - create service file for commence restore process + template: + src: files/commence-restore.service.j2 + dest: /etc/systemd/system/commence-restore.service - name: UFW - Allow connections to adminapi ports ufw: From e72f432926b6565b85fe4b51457fe37c608033ca Mon Sep 17 00:00:00 2001 From: Noah Moss Date: Thu, 24 Sep 2026 15:18:54 -0400 Subject: [PATCH 3/5] update adin.api.sudoers.conf and baseline.yml --- ansible/files/adminapi.sudoers.conf | 2 ++ audit-specs/baselines/baseline.yml | 6 ++++++ 2 files changed, 8 insertions(+) diff --git a/ansible/files/adminapi.sudoers.conf b/ansible/files/adminapi.sudoers.conf index f3bd7adc76..5e0b779401 100644 --- a/ansible/files/adminapi.sudoers.conf +++ b/ansible/files/adminapi.sudoers.conf @@ -36,6 +36,8 @@ Cmnd_Alias PGBOUNCER = /bin/systemctl start pgbouncer.service, /bin/systemctl st %adminapi ALL= NOPASSWD: /usr/bin/systemctl restart adminapi.service %adminapi ALL= NOPASSWD: /usr/bin/systemctl is-active commence-backup.service %adminapi ALL= NOPASSWD: /usr/bin/systemctl start commence-backup.service +%adminapi ALL= NOPASSWD: /usr/bin/systemctl start commence-restore.service +%adminapi ALL= NOPASSWD: /usr/bin/systemctl show -p LoadState commence-restore.service %adminapi ALL= NOPASSWD: /bin/systemctl daemon-reload %adminapi ALL= NOPASSWD: /bin/systemctl restart services.slice %adminapi ALL= NOPASSWD: /usr/sbin/nft -f /etc/nftables/supabase_managed.conf diff --git a/audit-specs/baselines/baseline.yml b/audit-specs/baselines/baseline.yml index c3f06554a7..d26d55543b 100644 --- a/audit-specs/baselines/baseline.yml +++ b/audit-specs/baselines/baseline.yml @@ -5371,6 +5371,12 @@ file: owner: "0" group: "0" filetype: file + /etc/systemd/system/commence-restore.service: + exists: true + mode: "0644" + owner: "0" + group: "0" + filetype: file /etc/systemd/system/database-optimizations.service: exists: true mode: "0644" From 06a7e93bba23eaf5f7963eb76b0524a8412a6880 Mon Sep 17 00:00:00 2001 From: Noah Moss Date: Mon, 28 Sep 2026 17:01:23 -0400 Subject: [PATCH 4/5] =?UTF-8?q?drop=20User=3Dadminapi=20from=20commence-re?= =?UTF-8?q?store=20service=20file=20=E2=80=94=C2=A0matches=20current=20sud?= =?UTF-8?q?o=20invocation=20of=20admin-mgr?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ansible/files/commence-restore.service.j2 | 1 - 1 file changed, 1 deletion(-) diff --git a/ansible/files/commence-restore.service.j2 b/ansible/files/commence-restore.service.j2 index 804aa906d2..b95857ddfb 100644 --- a/ansible/files/commence-restore.service.j2 +++ b/ansible/files/commence-restore.service.j2 @@ -4,7 +4,6 @@ Description=Async commence restore of physical backup [Service] Type=notify TimeoutStartSec=30 -User=adminapi ExecStart=/usr/bin/admin-mgr commence-restore --run-as-service true Restart=no OOMScoreAdjust=-1000 From 6e9cba19a12512936381e9e411953f853bcb637b Mon Sep 17 00:00:00 2001 From: Noah Moss Date: Tue, 29 Sep 2026 13:39:14 -0400 Subject: [PATCH 5/5] remove unneeded boolean from --run-as-service flag and unneeded sudoers line --- ansible/files/adminapi.sudoers.conf | 1 - ansible/files/commence-restore.service.j2 | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/ansible/files/adminapi.sudoers.conf b/ansible/files/adminapi.sudoers.conf index 5e0b779401..6c3eeb5763 100644 --- a/ansible/files/adminapi.sudoers.conf +++ b/ansible/files/adminapi.sudoers.conf @@ -37,7 +37,6 @@ Cmnd_Alias PGBOUNCER = /bin/systemctl start pgbouncer.service, /bin/systemctl st %adminapi ALL= NOPASSWD: /usr/bin/systemctl is-active commence-backup.service %adminapi ALL= NOPASSWD: /usr/bin/systemctl start commence-backup.service %adminapi ALL= NOPASSWD: /usr/bin/systemctl start commence-restore.service -%adminapi ALL= NOPASSWD: /usr/bin/systemctl show -p LoadState commence-restore.service %adminapi ALL= NOPASSWD: /bin/systemctl daemon-reload %adminapi ALL= NOPASSWD: /bin/systemctl restart services.slice %adminapi ALL= NOPASSWD: /usr/sbin/nft -f /etc/nftables/supabase_managed.conf diff --git a/ansible/files/commence-restore.service.j2 b/ansible/files/commence-restore.service.j2 index b95857ddfb..edcb55614f 100644 --- a/ansible/files/commence-restore.service.j2 +++ b/ansible/files/commence-restore.service.j2 @@ -4,6 +4,6 @@ Description=Async commence restore of physical backup [Service] Type=notify TimeoutStartSec=30 -ExecStart=/usr/bin/admin-mgr commence-restore --run-as-service true +ExecStart=/usr/bin/admin-mgr commence-restore --run-as-service Restart=no OOMScoreAdjust=-1000