Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1txNeJ-007pDY-3s for pgadmin-support@arkaria.postgresql.org; Wed, 26 Mar 2025 10:06:15 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1txNeH-0010BG-Lq for pgadmin-support@arkaria.postgresql.org; Wed, 26 Mar 2025 10:06:13 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1txNeH-0010B8-CE for pgadmin-support@lists.postgresql.org; Wed, 26 Mar 2025 10:06:13 +0000 Received: from mail-ua1-x92b.google.com ([2607:f8b0:4864:20::92b]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.96) (envelope-from ) id 1txNeD-001G7J-1k for pgadmin-support@lists.postgresql.org; Wed, 26 Mar 2025 10:06:12 +0000 Received: by mail-ua1-x92b.google.com with SMTP id a1e0cc1a2514c-86feb84877aso520557241.3 for ; Wed, 26 Mar 2025 03:06:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=enterprisedb.com; s=google; t=1742983567; x=1743588367; darn=lists.postgresql.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=tnACmA4fwj3Tt4vI0Q2dSyb0KR8P5Omb2eJGuReEoF0=; b=kcYW6omf1dRFiWxU1F1+1HAAUYB2eCypwWbsRdY4O7/o4TWThK/93Vz7duSq0F9H7D Qy4rXddzCqk1LNXeNENLd7nCWmSfDYIeUuNoMiPQHyfTJl+ib1gCsl4zaEIKF6o3BLk0 eGPP4eTW5nkY2vqPG6dXhOS0H/OFXuAoTfe9XObFG7nU+l61PlriC68QYlf98DHz/PQ/ 9LLox0YDO2Q3G+sSHlx1OIn0jp27wAw0lHn+BOTsqMrdm5O79yK4Z0zbhko+EF67m3/v CEW4s2ZOLeh2bRvruPdk/4F5Z2idfO+YSuEWZqytpC3dlcJjDSvbBvcy/ixnIvAhiIw8 9DJQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1742983567; x=1743588367; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=tnACmA4fwj3Tt4vI0Q2dSyb0KR8P5Omb2eJGuReEoF0=; b=iU0z9nJdEy8VLTr6yNmFKZnB8SLNwy1bkBMKbVinxeXlXjuZ5iFOYmfF5bdUaEYK+p pH7aUGmF3QYN19TYGSsKWS8o8F1pMU/QElDAUU7sO8fuNJaxMrSScgW7K6PlBn6QlM/K CtOPISPykAXHxTnce6511yn4jGdl7PUHPGRdhpTesUK9YZfBtvO+HEjmd7l3BsmgwFk3 Arm/idB/8vmFOvfbVgE7iYXfUd2PP6ORe3v2eTjeSeHsZZntLeSFXp7JaI3+RxS6jqfa 2VQ6s6kO5csj3Xmusw+oXy74+bqdtXVbzj+nmvG5c7M0LYImvP26J3JWVtLSUbOk2ztI LiTA== X-Gm-Message-State: AOJu0Yyl32mVbiE952pC0Kqeu8OCN0YLkxEsAnw95jFIkuHfM8b9pik2 n2s6NyGGxrA4RhCBfa7H9uZGizwVSrIlu48Zv9EXiufaUHdoAAQvA9yoO8rMMHQD8mdWom7eF/R 0EGjCxDqtso2qo0oXZJeZ5XI/Q6b4woib2tN0dWZAj6+/pl6pW2Lo X-Gm-Gg: ASbGncu7QEiCmE68Gq9yMenfIwtZTzXvk/vPafReBnGiNnYzqqOcuqHzSx61/SNgpyn rAitOJD8VBMxyMoufheu7jl/fX2JlQHNL3aBocSFPDXOGeXZPAaepOx4Vd1egG7BNGZHRlOy1MA EPskRSkwl1oqhwpFIsUE6lRXxGvNar2uooThFLLqZZSLtAHpmnmiW9Lh7/XH4K X-Google-Smtp-Source: AGHT+IHZugZ6rAbggf9bo3Oz7a9uXNsQHnlXrfIebQNCp8RkcjI748PF9UGklVWLfWqFmWCVwk1lr1wQgpLt7IGbNb0= X-Received: by 2002:a05:6102:5241:b0:4c4:dead:59a3 with SMTP id ada2fe7eead31-4c50d496a1cmr16779438137.2.1742983566540; Wed, 26 Mar 2025 03:06:06 -0700 (PDT) MIME-Version: 1.0 References: <23879802.6Emhk5qWAg@nap> In-Reply-To: <23879802.6Emhk5qWAg@nap> From: Aditya Toshniwal Date: Wed, 26 Mar 2025 15:35:30 +0530 X-Gm-Features: AQ5f1JohwcyRyzxVK1IbArNhiINzDPoOQ1N9UL1N80hzBcXwz67QE3aurO4hW54 Message-ID: Subject: Re: Docker setup without password To: Lutz Badenheuer Cc: pgadmin-support@lists.postgresql.org Content-Type: multipart/alternative; boundary="00000000000055871406313bfc21" List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --00000000000055871406313bfc21 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Lutz, Did you try removing pgpass from configs? PGPASS_FILE should be enough. On Wed, Mar 26, 2025 at 3:05=E2=80=AFPM Lutz Badenheuer = wrote: > Hello everybody, > > I'd like to deploy PgAdmin4 with Ansible to a Docker Swarm cluster withou= t > any > authentication and authorization, as it will not be exposed to the public= . > > Only internal SSH users will be able to access the SSH tunnel endpoint, a > unix > domain socket. These users are already authenticated with their SSH publi= c > key > and a second factor, and each of them is an experienced, trusted user. > > Unfortunately, PgAdmin4 makes it very hard for me to accomplish this, or > maybe > I didn't find or understand the relevant documentation. I have already > managed > to automatically login into PgAdmin4 by forcing it into desktop mode, but > when > I try to open a database in the menu on the left side, PgAdmin4 keeps > asking > for a password -- which has already been supplied with a PGPASS_FILE. > > Please, don't get me wrong: I highly appreciate when developers try to > develop > their software as secure as possible, thus protecting unexperienced users > from > insecure setups. And to be honest, I'm also not happy with having to forc= e > the > software into desktop mode just to circumvent having to log into PgAdmin4= . > But > then, having to spread passwords and add documentation to our projects > just so > my users can access that database doesn't make me happy either. > > What I have already accomplished and tried so far: > > - force PgAdmin4 into desktop mode (PGADMIN_CONFIG_SERVER_MODE: "False"), > thus > omitting the need to login into PgAdmin4 > - adding a PGPASS_FILE (with and without leading dots) with Docker config= s > to > - /var/lib/pgadmin/pgpass > - /var/lib/pgadmin/pgpass/storage/sw_lukenukem.de/pgpass > - setting the correct password in servers.json with the settings > - Password > - PassFile > > At the moment, the service configuration in my docker-compose.yml looks > like > so (and no, please rest assured that s3cR3t is not the real password ;-): > > --snip----- > pgadmin: > image: dpage/pgadmin4:latest > environment: > PGADMIN_DEFAULT_EMAIL: "sw@lukenukem.de" > PGADMIN_DEFAULT_PASSWORD: "s3cR3t" > PGADMIN_LISTEN_ADDRESS: "0.0.0.0" > PGADMIN_DISABLE_POSTFIX: "True" > PGADMIN_CONFIG_SERVER_MODE: "False" > PGADMIN_CONFIG_MASTER_PASSWORD_REQUIRED: "False" > PGPASS_FILE: "/var/lib/pgadmin/pgpass" > configs: > - source: servers_json > target: /pgadmin4/servers.json > - source: pgpass > target: /var/lib/pgadmin/pgpass > uid: "5050" > gid: "0" > mode: 0600 > - source: pgpass > target: /var/lib/pgadmin/storage/sw_lukenukem.de/pgpass > uid: "5050" > gid: "0" > mode: 0600 > --snip----- > > However, after reading the documentation over and over and playing around > with > several configuration options, I'm at the end of my ideas. Any suggestion= s > and > hints are very welcome. If you need more information, please let me know. > > Thank you in advance and please excuse my bad english, I know I lack > training. > > Best wishes, > Lutz > --=20 Thanks, Aditya Toshniwal pgAdmin Hacker | Sr. Staff SDE II | *enterprisedb.com* "Don't Complain about Heat, Plant a TREE" --00000000000055871406313bfc21 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi=C2=A0Lutz,

Did you try removing pgpass from config= s?=C2=A0PGPASS_FILE should be enough.

On = Wed, Mar 26, 2025 at 3:05=E2=80=AFPM Lutz Badenheuer <luke@lukenukem.de> wrote:
Hello everybody,

I'd like to deploy PgAdmin4 with Ansible to a Docker Swarm cluster with= out any=C2=A0
authentication and authorization, as it will not be exposed to the public. =

Only internal SSH users will be able to access the SSH tunnel endpoint, a u= nix
domain socket. These users are already authenticated with their SSH public = key
and a second factor, and each of them is an experienced, trusted user.

Unfortunately, PgAdmin4 makes it very hard for me to accomplish this, or ma= ybe
I didn't find or understand the relevant documentation. I have already = managed
to automatically login into PgAdmin4 by forcing it into desktop mode, but w= hen
I try to open a database in the menu on the left side, PgAdmin4 keeps askin= g
for a password -- which has already been supplied with a PGPASS_FILE.

Please, don't get me wrong: I highly appreciate when developers try to = develop
their software as secure as possible, thus protecting unexperienced users f= rom
insecure setups. And to be honest, I'm also not happy with having to fo= rce the
software into desktop mode just to circumvent having to log into PgAdmin4. = But
then, having to spread passwords and add documentation to our projects just= so
my users can access that database doesn't make me happy either.

What I have already accomplished and tried so far:

- force PgAdmin4 into desktop mode (PGADMIN_CONFIG_SERVER_MODE: "False= "), thus
=C2=A0 omitting the need to login into PgAdmin4
- adding a PGPASS_FILE (with and without leading dots) with Docker configs = to
=C2=A0 - /var/lib/pgadmin/pgpass
=C2=A0 - /var/lib/pgadmin/pgpass/storage/sw_lukenukem.de/pgpass
- setting the correct password in servers.json with the settings
=C2=A0 - Password
=C2=A0 - PassFile

At the moment, the service configuration in my docker-compose.yml looks lik= e
so (and no, please rest assured that s3cR3t is not the real password ;-): <= br>
--snip-----
pgadmin:
=C2=A0 image: dpage/pgadmin4:latest
=C2=A0 environment:
=C2=A0 =C2=A0 PGADMIN_DEFAULT_EMAIL: "sw@lukenukem.de"
=C2=A0 =C2=A0 PGADMIN_DEFAULT_PASSWORD: "s3cR3t"
=C2=A0 =C2=A0 PGADMIN_LISTEN_ADDRESS: "0.0.0.0"
=C2=A0 =C2=A0 PGADMIN_DISABLE_POSTFIX: "True"
=C2=A0 =C2=A0 PGADMIN_CONFIG_SERVER_MODE: "False"
=C2=A0 =C2=A0 PGADMIN_CONFIG_MASTER_PASSWORD_REQUIRED: "False" =C2=A0 =C2=A0 PGPASS_FILE: "/var/lib/pgadmin/pgpass"
=C2=A0 configs:
=C2=A0 =C2=A0 - source: servers_json
=C2=A0 =C2=A0 =C2=A0 target: /pgadmin4/servers.json
=C2=A0 =C2=A0 - source: pgpass
=C2=A0 =C2=A0 =C2=A0 target: /var/lib/pgadmin/pgpass
=C2=A0 =C2=A0 =C2=A0 uid: "5050"
=C2=A0 =C2=A0 =C2=A0 gid: "0"
=C2=A0 =C2=A0 =C2=A0 mode: 0600
=C2=A0 =C2=A0 - source: pgpass
=C2=A0 =C2=A0 =C2=A0 target: /var/lib/pgadmin/storage/sw_lukenukem.de/p= gpass
=C2=A0 =C2=A0 =C2=A0 uid: "5050"
=C2=A0 =C2=A0 =C2=A0 gid: "0"
=C2=A0 =C2=A0 =C2=A0 mode: 0600
--snip-----

However, after reading the documentation over and over and playing around w= ith
several configuration options, I'm at the end of my ideas. Any suggesti= ons and
hints are very welcome. If you need more information, please let me know. <= br>
Thank you in advance and please excuse my bad english, I know I lack traini= ng.

Best wishes,
Lutz


--
Thanks,
Aditya Toshniw= al
pgAdmin Hacker=C2=A0| Sr. Staff SDE II=C2= =A0| enterprisedb.com
"Don't Complain about Heat, Plant a TREE"
--00000000000055871406313bfc21--