Mike Reeves ad78e84ccd Prevent PostgreSQL from leaking plaintext passwords to postgres.log ...

PostgreSQL's log_min_error_statement defaults to 'error', so whenever a
CREATE/ALTER ROLE ... PASSWORD statement errored, the full statement text --
including the plaintext password -- was written to /opt/so/log/postgres/postgres.log.
The role-provisioning paths (init-db.sh for so_postgres, so-telegraf-postgres
for per-minion telegraf roles) both dispatch such DDL, the latter on every
state.apply.

- init-db.sh / so-telegraf-postgres: SET log_min_error_statement = panic before
  the password-bearing DDL so an error no longer emits the STATEMENT line. The
  ERROR message itself (no password) still logs, preserving debuggability.
- logrotate: add a postgres stanza (daily, keep 14, copytruncate, compress) so
  postgres.log is rotated like every other service and leaked content can't
  persist indefinitely. copytruncate is required because the container holds the
  log open via redirected stderr.
- soup: scrub any already-logged PASSWORD lines from postgres.log during
  post_to_3.2.0, rewriting in place to preserve the inode postgres is writing to.

2026-07-20 12:41:14 -04:00

..

etc

replace . with _x_

2023-06-30 14:18:20 -04:00

tools/sbin

configure logrotate through soc

2023-06-30 11:26:55 -04:00

defaults.yaml

Prevent PostgreSQL from leaking plaintext passwords to postgres.log

2026-07-20 12:41:14 -04:00

init.sls

desktop doesnt need docker state

2023-08-29 09:05:01 -04:00

map.jinja

start of logrotate configurable via ui

2023-06-29 12:54:37 -04:00

soc_logrotate.yaml

Prevent PostgreSQL from leaking plaintext passwords to postgres.log

2026-07-20 12:41:14 -04:00