supabase-postgres.git / summary / log / commit / refs
commit 47d3ff319a0ead8a5a9a2e7dad5950a487834c58
Author: Cuong Do <cuongdo@users.noreply.github.com>
Commit: GitHub <noreply@github.com>
Date: Mon Jul 13 21:39:21 2026 +0000
fix: load supautils in the multigres pgctld config templates (#2270)
* test: verify pgctld-rendered multigres config loads supautils
* fix: load supautils in the multigres-17 pgctld config template
* fix: load supautils in the multigres-orioledb-17 pgctld config template
* docs: note supautils parity in multigres-image.md
* fix: track docker/pgctld in Docker image change-detection hash
docker/pgctld/*.tmpl and pgctld-wrapper.sh are COPY'd directly into the
multigres image by Dockerfile-multigres, but were missing from the
dockerSources fileset that gates whether CI's Docker Image Test workflow
runs. As a result, this branch's own fix (and its new pgctld integration
checks) never triggered the multigres-17/multigres-orioledb-17 test job.
docker/pgctld/orioledb-postgresql.conf.tmpl | 5 ++++
docker/pgctld/postgresql.conf.tmpl | 5 ++++
docs/multigres-image.md | 1 +
nix/packages/docker-image-inputs.nix | 3 +++
nix/packages/docker-image-test.nix | 37 ++++++++++++++++++++++++++---
5 files changed, 48 insertions(+), 3 deletions(-)
diff --git a/docker/pgctld/orioledb-postgresql.conf.tmpl b/docker/pgctld/orioledb-postgresql.conf.tmpl
index 13a60e84..7478f8d0 100644
--- a/docker/pgctld/orioledb-postgresql.conf.tmpl
+++ b/docker/pgctld/orioledb-postgresql.conf.tmpl
@@ -229,6 +229,8 @@ default_text_search_config = 'pg_catalog.english'
# - Shared Library Preloading -
+session_preload_libraries = 'supautils'
+
jit_provider = 'llvmjit' # JIT library to use
# - Other Defaults -
@@ -274,6 +276,9 @@ restart_after_crash = off # reinitialize after backend crash?
# WAL-G specific configurations
+# supautils specific configurations
+include = '/etc/postgresql-custom/supautils.conf'
+
#------------------------------------------------------------------------------
# CUSTOMIZED OPTIONS
#------------------------------------------------------------------------------
diff --git a/docker/pgctld/postgresql.conf.tmpl b/docker/pgctld/postgresql.conf.tmpl
index 51c30f5c..4cace57d 100644
--- a/docker/pgctld/postgresql.conf.tmpl
+++ b/docker/pgctld/postgresql.conf.tmpl
@@ -229,6 +229,8 @@ default_text_search_config = 'pg_catalog.english'
# - Shared Library Preloading -
+session_preload_libraries = 'supautils'
+
shared_preload_libraries = 'pg_stat_statements, pgaudit, plpgsql, plpgsql_check, pg_cron, pg_net, auto_explain, pg_tle, plan_filter, supabase_vault'
jit_provider = 'llvmjit' # JIT library to use
@@ -276,6 +278,9 @@ restart_after_crash = off # reinitialize after backend crash?
# WAL-G specific configurations
+# supautils specific configurations
+include = '/etc/postgresql-custom/supautils.conf'
+
#------------------------------------------------------------------------------
# CUSTOMIZED OPTIONS
#------------------------------------------------------------------------------
diff --git a/docs/multigres-image.md b/docs/multigres-image.md
index 3bf9d6e2..5bdaf0b2 100644
--- a/docs/multigres-image.md
+++ b/docs/multigres-image.md
@@ -19,6 +19,7 @@ dependencies, copies config files, and runs database migrations.
| Config source | `/etc/postgresql/postgresql.conf` | Same |
| Data directory | `/var/lib/postgresql/data` | Same |
| pgsodium | Enabled | **Not enabled** (extension not created) |
+| supautils | Enabled | Enabled |
| supabase_vault | Enabled | Enabled |
| pgsodium_getkey.sh | Present | Present (required by vault at startup) |
diff --git a/nix/packages/docker-image-inputs.nix b/nix/packages/docker-image-inputs.nix
index 48506e14..fc9caa42 100644
--- a/nix/packages/docker-image-inputs.nix
+++ b/nix/packages/docker-image-inputs.nix
@@ -34,6 +34,9 @@ let
(root + "/ansible/files/postgresql_extension_custom_scripts")
(root + "/ansible/files/walg_helper_scripts")
+ # pgctld config templates + wrapper script (copied into the multigres image)
+ (root + "/docker/pgctld")
+
# Database migrations (copied into images)
(root + "/migrations/db")
];
diff --git a/nix/packages/docker-image-test.nix b/nix/packages/docker-image-test.nix
index 9717de70..6cdeec40 100644
--- a/nix/packages/docker-image-test.nix
+++ b/nix/packages/docker-image-test.nix
@@ -337,8 +337,39 @@ writeShellApplication {
fi
log_info " ✓ pgctld start --pooler-dir $pooler_dir"
+ # 5. session_preload_libraries must include supautils — pgctld renders
+ # postgresql.conf from a separate template
+ # (/etc/pgctld-custom/*.conf.tmpl) than the static
+ # /etc/postgresql/postgresql.conf the SQL regression suite uses, so
+ # that suite alone can't catch supautils being missing from the
+ # template.
+ local session_pl
+ session_pl=$(docker exec -e PGPASSWORD="$POSTGRES_PASSWORD" "$container" sh -c "
+ psql -U $POSTGRES_USER -d postgres -h $pooler_dir/pg_sockets \
+ -tAc \"SHOW session_preload_libraries;\" 2>&1") || true
+ if ! echo "$session_pl" | grep -q "supautils"; then
+ log_error " supautils not in session_preload_libraries (got: $session_pl)"
+ log_error " Check that the pgctld config template sets session_preload_libraries = 'supautils'"
+ exit 1
+ fi
+ log_info " ✓ session_preload_libraries contains supautils"
+
+ # 6. supautils.conf's actual policy must be loaded (not just the
+ # library) — supautils.policy_grants should contain the
+ # realtime.messages grant real supautils.conf.j2 defines.
+ local policy_grants
+ policy_grants=$(docker exec -e PGPASSWORD="$POSTGRES_PASSWORD" "$container" sh -c "
+ psql -U $POSTGRES_USER -d postgres -h $pooler_dir/pg_sockets \
+ -tAc \"SHOW supautils.policy_grants;\" 2>&1") || true
+ if ! echo "$policy_grants" | grep -q "realtime.messages"; then
+ log_error " supautils.policy_grants missing expected policy (got: $policy_grants)"
+ log_error " Check that the pgctld config template includes /etc/postgresql-custom/supautils.conf"
+ exit 1
+ fi
+ log_info " ✓ supautils.conf policy loaded (policy_grants set)"
+
if [[ "$version" == "multigres-orioledb-17" ]]; then
- # 5. /usr/local/bin/pgctld must be a wrapper script (not a plain symlink)
+ # 7. /usr/local/bin/pgctld must be a wrapper script (not a plain symlink)
local first_line
first_line=$(docker exec "$container" sh -c "head -1 /usr/local/bin/pgctld")
if [[ "$first_line" != "#!/bin/sh" ]]; then
@@ -347,7 +378,7 @@ writeShellApplication {
fi
log_info " ✓ /usr/local/bin/pgctld is a wrapper script"
- # 6. shared_preload_libraries must include orioledb — injected by wrapper, no flags needed
+ # 8. shared_preload_libraries must include orioledb — injected by wrapper, no flags needed
local spl
spl=$(docker exec -e PGPASSWORD="$POSTGRES_PASSWORD" "$container" sh -c "
psql -U $POSTGRES_USER -d postgres -h $pooler_dir/pg_sockets \
@@ -359,7 +390,7 @@ writeShellApplication {
fi
log_info " ✓ shared_preload_libraries contains orioledb"
- # 7. default_table_access_method must be orioledb
+ # 9. default_table_access_method must be orioledb
local tam
tam=$(docker exec -e PGPASSWORD="$POSTGRES_PASSWORD" "$container" sh -c "
psql -U $POSTGRES_USER -d postgres -h $pooler_dir/pg_sockets \
[parent: cb178649205a]