Give a plugin a Postgres database of its own #78

Merged

lilleman merged 8 commits from plugin-storage into main 2026-08-20 21:52:15 +02:00

Conversation 0 Commits 8 Files Changed 27

+955 -74

lilleman commented 2026-08-18 23:12:22 +02:00

Owner

Copy Link

Copy Source

A plugin sets storage: true and gets a Postgres database and login role of its own, both named plugin_<id>, with the credentials handed to onBoot.

The host hands over credentials, not a client — a plugin depends on whichever driver it likes, so no driver shape enters the contract. Passwords are derived (HMAC-SHA256(PLUGIN_DB_SECRET, id)) rather than stored, keeping the host free of state. Only bootstrap gets the superuser DSN, since plugin code runs inside web and can read that process' environment.

HOST_API_VERSION stays at 1.0.0 per the recorded freeze — the change is additive and a zero-argument onBoot remains valid.

A plugin sets `storage: true` and gets a Postgres database and login role of its own, both named `plugin_<id>`, with the credentials handed to `onBoot`. The host hands over credentials, not a client — a plugin depends on whichever driver it likes, so no driver shape enters the contract. Passwords are derived (`HMAC-SHA256(PLUGIN_DB_SECRET, id)`) rather than stored, keeping the host free of state. Only `bootstrap` gets the superuser DSN, since plugin code runs inside `web` and can read that process' environment. `HOST_API_VERSION` stays at 1.0.0 per the recorded freeze — the change is additive and a zero-argument `onBoot` remains valid.

lilleman added 1 commit 2026-08-18 23:12:22 +02:00

Give a plugin a Postgres database of its own bf638dfb19

lilleman added 1 commit 2026-08-18 23:24:39 +02:00

Refuse a throwaway plugin storage secret in bootstrap, before any role is created bba048e38f

lilleman marked the pull request as work in progress 2026-08-18 23:24:58 +02:00

lilleman added 1 commit 2026-08-19 00:08:40 +02:00

Confine the Postgres driver to bootstrap, bound plugin connections, and gate the storage DDL ae8f105360

lilleman added 1 commit 2026-08-19 00:20:22 +02:00

Isolate the storage CI stack, prove least-privilege provisioning, drop the secret before discovery 6db14a2205

lilleman added 1 commit 2026-08-19 00:44:55 +02:00

Keep role re-assertion within a non-superuser provisioner's rights, and test the second boot c5c9cce2b6

lilleman added 1 commit 2026-08-19 01:03:45 +02:00

Warn rather than refuse on a storage URL mismatch, and scrub the provisioning DSN before discovery 47541ae97b

lilleman marked the pull request as ready for review 2026-08-19 01:07:04 +02:00

lilleman added 1 commit 2026-08-19 20:34:39 +02:00

Merge remote-tracking branch 'origin/main' into plugin-storage ... 03d14b1a20

# Conflicts:
#	package-lock.json
#	package.json

lilleman added 1 commit 2026-08-20 21:47:27 +02:00

Merge remote-tracking branch 'origin/main' into plugin-storage ... 4f791d8f11

# Conflicts:
#	package-lock.json
#	package.json

lilleman merged commit 4f791d8f11 into main 2026-08-20 21:52:15 +02:00

lilleman deleted branch plugin-storage 2026-08-20 21:52:15 +02:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

claes.eismar.se lilleman (Lilleman auf Larv) martin.siden renovate-bot

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: larvit/plainpages#78