root/sp
1
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

docs: mark super_panel_reader role as done

Browse Source 
Role created on the Sase.tr standalone Postgres with SELECT-only
privileges on schema public + ALTER DEFAULT PRIVILEGES so future
tables inherit the grant. Panel-web DATABASE_URL_SASE_RO switched to
this role; panel redeployed; UPDATE/INSERT/DELETE rejected with
'permission denied' as expected; SELECT count(*) FROM users still
works.

Process: temporarily exposed sase-postgres on port 54320, ran the
SQL via psql, then closed the public port. Password generated with
openssl rand -hex 24 (lives only in Coolify env).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Semih
2026-05-18 16:46:22 +03:00
parent d0f0cadf51
commit 230ef63433
1 changed files with 2 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
teknikborc.md
View File

@@ -63,19 +63,9 @@ Faz 1–4 + regression alert **shipped** (2026-05-18):
## Defansif teknik borç
### super_panel_reader DB rolü (Sase RO defense-in-depth)
### ~~super_panel_reader DB rolü~~ — DONE (2026-05-18)
Panel `DATABASE_URL_SASE_RO` env'i şu an `sase` **superuser** ile çalışıyor (Coolify standalone DB `v48gwwo48w8gg0ko0wg0ocko:5432`). Panel sadece SELECT yapıyor ama defense-in-depth için ayrı bir SELECT-only rolü oluşturulmalı.
```sql
CREATE ROLE super_panel_reader LOGIN PASSWORD '<rand>';
GRANT CONNECT ON DATABASE sase TO super_panel_reader;
GRANT USAGE ON SCHEMA public TO super_panel_reader;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO super_panel_reader;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO super_panel_reader;
```
Sonra panel-web `DATABASE_URL_SASE_RO` env'ini bu rolün URL'ine çevir + redeploy. Sase-postgres'e Coolify exec yok; Coolify terminal UI veya geçici public port gerekir.
Panel `DATABASE_URL_SASE_RO` env'i artık `super_panel_reader` rolüyle bağlanıyor. Smoke test doğrulandı: SELECT çalışıyor, UPDATE/INSERT/DELETE → `permission denied for table`. Rol Coolify standalone postgres'te `GRANT SELECT ON ALL TABLES IN SCHEMA public` + `ALTER DEFAULT PRIVILEGES` ile kuruldu (geçici public port üzerinden psql ile, sonra port kapatıldı).
### `prisma db push` multi-replica güvensizliği