| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
The password-update task was gated behind soju_reset_password, which
nothing ever set. A vault password rotation silently never took effect,
so soju kept authenticating against the pre-rotation password for 7
months. Track a hash of the last-applied password instead and reapply
whenever it differs from the vault, so a rotation takes effect on the
next run without a manual nudge.
|
|
dash echo mangles backslash escapes, and soju authenticates against its
in-memory copy so sojudb changes need a restart to take effect.
|
|
The unconditional change-password re-keyed the account on every run,
clobbering any password changed in-band and locking out clients.
|
|
relayer had Requires= without After=, which does not order startup;
soju's packaged unit has no postgres ordering at all, so both raced
the postgres socket at boot and stayed failed. Adds After= to the
relayer unit and a systemd drop-in for soju.
|
|
- soju: add change-password task so admin password updates on every
playbook run via sojudb change-password
- postgresql: remove superuser password task — postgres uses peer auth
(Unix socket), no password needed or desired
|
|
|
|
|
