services.mysql.initalScript runs with the root@localhost mysql user.
This seems consistent with the other invocations that run in the first
startup of mysql.
After the security fix, the mysql command executing the initial script
was broken as it tried to connect to root@localhost while being the mysql
system user.
We could instead use the mysql@localhost mysql user, but this would be
inconsistent with the other invocations.
Co-Authored-By: osnyx <os@flyingcircus.io>
Existing deployments using MySQL or Percona Server with `services.mysql`
do not restrict authentication to the root@localhost user allowing any
user on the system to log in without a password.
With this changes:
* new deployments will use the `auth_socket` authentication by default
to only allow the local root user to log in as the MySQL root user
* existing deployments with a stateVersion > 26.05 will also be moved to
the `auth_socket` authentication
* existing deployments with a stateVersion <= 26.05 have a warning
logged when the local authentication seems to be open
Users can disable this behavior by setting `services.mysql.secureSuperUserByDefault`
to `false`.
`plv8` depends on the outdated NodeJS 20. Upstream waits for v8-cmake to
make a move (https://github.com/plv8/plv8/issues/610), but that project
has been inactive for a bit more than a year.
Even when allowing the insecure nodejs20, the package fails to build.
Insecure and broken - we might as well drop it.
To avoid confusion and spurious newlines in the output.
Found by searching for a backslash followed by a newline, some
indentation, and then the end of multi-line string marker, using the
following extended regex:
```regex
\\\n +'';
```
Avoids trying to set the primary group of the redis user to a group that doesn't exist.
Signed-off-by: Julia DeMille <me@jdemille.com>
Change-Id: Ic67fb735ca739a13b95e98675994de376a6a6964
- Add sentinelMasterHost, sentinelMasterPort, sentinelMasterQuorum
options
- Add special handling for mutable state in /var/lib/redis-xxx
Redis/Valkey Sentinel persists dynamic cluster state by rewriting its
configuration file at runtime. This behaviour cannot be disabled.
Add conditional preStart logic to avoid overwriting Sentinel-owned
configuration while preserving NixOS-managed defaults. This introduces
a necessary, documented deviation from strict declarative semantics.
ChangeLog: https://docs.victoriametrics.com/victoriatraces/changelog/#v060
Just like victoriametrics[1], we now need to allow `mincore`:
SECCOMP auid=4294967295 uid=61888 gid=61888 ses=4294967295 pid=859923 comm="victoria-traces" exe="/nix/store/kxqhlmqdc6ml4l9asb69w39yny88hmvf-VictoriaTraces-0.6.0/bin/victoria-traces" sig=31 arch=c000003e syscall=27 compat=0 ip=0x40578e code=0x80000000
[1] efca7ca9dc
- Add Redis auth options that are important for running a
secure Redis infrastructure
- `masteruser` and `masterauth` for authentication between
replicas and master
- `sentinel auth-user` and `sentinel auth-pass` to provide
credentials that a Sentinel instance should use to
authenticate to the Redis instance it is monitoring
- Add assertions to catch configuration issues before
build/deployment
Signed-off-by: Ashley Hooper <ashleyghooper@gmail.com>
This commit adds a freeform type to accomodate for new options to use
with ALTER ROLE.
It also will perform extra checking and conversion for options with
parameters.
Converts option names into upper case with space instead of underscore.
K900