recipe_alpine_postgres.ts

Alpine PostgreSQL bootstrap. Alpine ships PostgreSQL in its own repos, so there is no third-party-repo step (the Debian postgres_apt_repo has no Alpine analogue); install it with zap.pkg({id: 'postgres', from: {apk: 'postgresql<version>'}}) plus postgresql<version>-openrc for the OpenRC service.

The one thing apk does NOT do that Debian's apt does is initialize the data cluster — alpine_postgres_setup supplies that as an idempotent script, run once before the postgresql service starts. The OpenRC service is the version-agnostic postgresql (Alpine's postgresql-common wrapper picks the installed major).

Pure function evaluated in zap's sandboxed config eval (fgro eval).

view source

Declarations
#

3 declarations

alpine_postgres_setup
#

recipe_alpine_postgres.ts view source

(options: AlpinePostgresSetupOptions): AlpinePostgresSetupScript import {alpine_postgres_setup} from '@fuzdev/zap/recipe_alpine_postgres.js';

Build the postgres-cluster-init script's check/run for Alpine.

run initializes the data cluster via the OpenRC setup action (Alpine's apk install does not, unlike Debian's apt), then closes the trust rules that action's initdb writes into the new pg_hba.conf: local lines become peer (the OS account named like the role) and host lines scram-sha-256 (a password), so no account on the machine connects as any role, postgres included, without a credential. Debian's cluster starts with those methods. The rewrite runs as postgres, which owns the file and its directory (sed -i stages its copy there), and the script fails if a trust rule is left. A server already running is told to reload (rc-service --ifstarted), so the new rules are in force.

check passes once the cluster's PG_VERSION marker exists and its pg_hba.conf holds no trust rule. So a run that failed after setup is retried on the next apply, and that run skips setup (the cluster is there) and goes straight to the rewrite; a cluster set up before this recipe, trust rules and all, is rewritten the same way.

A client that relied on a trust rule stops connecting. Every trust line in the file is rewritten, not only initdb's: a service that reaches PostgreSQL over TCP with no password is refused once the rewrite is in force, and one on the socket is admitted only as the OS account named like its role. Move such a client to the socket as its own account (fuz_app_env_base's DATABASE_URL), or give it a password, before this runs on an existing cluster. Sequence it before the postgresql service (the setup action requires the server stopped) and before any zap.database.

`options`

type AlpinePostgresSetupOptions

returns

AlpinePostgresSetupScript

the script check/run pair.

AlpinePostgresSetupOptions
#

recipe_alpine_postgres.ts view source

AlpinePostgresSetupOptions import type {AlpinePostgresSetupOptions} from '@fuzdev/zap/recipe_alpine_postgres.js';

Options for alpine_postgres_setup.

`version`

The installed PostgreSQL major version — matches apk add postgresql<version> and the /var/lib/postgresql/<version>/data cluster path. Pin it to the major your other hosts run, for replication and restore compatibility.

type number | string

AlpinePostgresSetupScript
#

recipe_alpine_postgres.ts view source

AlpinePostgresSetupScript import type {AlpinePostgresSetupScript} from '@fuzdev/zap/recipe_alpine_postgres.js';

The check/run pair alpine_postgres_setup returns (caller supplies id/name/depends_on).

`check`

Check command — exit 0 means the script is already applied (skip).

type string

`run`

The command the planner emits when the check fails.

type string