supabase-postgres.git / summary / log / commit / refs

commit    7ce04f4699cd0def32cdd1166ccbe728b06cda38
Author:   Etienne Stalmans <staaldraad@users.noreply.github.com>
Commit:   GitHub <noreply@github.com>
Date:     Tue Oct 14 04:05:57 2025 +0000

    chore: systemd hardening (#1837)
    
    * chore: systemd hardening
    
    ProtectHome and InaccessiblePaths to senstive internal locations
    
    * Apply suggestion from @pcnc
    
    Co-authored-by: Paul Cioanca <paul.cioanca@supabase.io>
    
    * chore: more paths
    
    ---------
    
    Co-authored-by: Paul Cioanca <paul.cioanca@supabase.io>


 ansible/files/postgresql_config/postgresql.service.j2 | 4 +++-
 ansible/vars.yml                                      | 6 +++---
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/ansible/files/postgresql_config/postgresql.service.j2 b/ansible/files/postgresql_config/postgresql.service.j2
index 4cc138ec..30bbd5f6 100644
--- a/ansible/files/postgresql_config/postgresql.service.j2
+++ b/ansible/files/postgresql_config/postgresql.service.j2
@@ -22,7 +22,9 @@ OOMScoreAdjust=-1000
 EnvironmentFile=-/etc/environment.d/postgresql.env
 LimitNOFILE=16384
 {% if supabase_internal is defined %}
-ReadOnlyPaths=/etc
+ProtectHome=yes
+ReadOnlyPaths=/etc /opt
+InaccessiblePaths=-/var/lib/supabase -/var/lib/supabase-admin-agent -/var/lib/cloud -/var/cache/supabase-admin-agent -/opt/saltstack -/etc/salt
 {% endif %}
 [Install]
 WantedBy=multi-user.target
diff --git a/ansible/vars.yml b/ansible/vars.yml
index 0a9e3bd8..0f77b182 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -10,9 +10,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.5.1.042-orioledb"
-  postgres17: "17.6.1.021"
-  postgres15: "15.14.1.021"
+  postgresorioledb-17: "17.5.1.043-orioledb"
+  postgres17: "17.6.1.022"
+  postgres15: "15.14.1.022"
 
 # Non Postgres Extensions
 pgbouncer_release: 1.19.0


[parent: 309557bfc0f2]