feat(manage-server): sync pg_tde encryption-at-rest installer changes #28

Merged

amiryahaya merged 2 commits from feat/pg-tde-migration into main

2026-09-17 15:54:20 +02:00

amiryahaya commented

2026-09-17 15:30:50 +02:00

Owner

Mirrors triton PR #1052 (issue #1050): swaps the bundled Postgres image to percona/percona-distribution-postgresql:18 (ships pg_tde built in), adds pg-tde-bootstrap.sh, and adds an ensure_pg_tde() retrofit step to upgrade.sh for already-deployed installs.

Includes two fixes found while verifying the source PR end-to-end (not present in the source repo's first push, both added before this sync):

The keyring lives as a plain subdirectory of PGDATA, not a separate volume — an independently-mounted volume comes back root-owned on real Docker with no way to fix it, since this image runs as a non-root user from its very first process.
ensure_pg_tde() discovers the running container's actual PGDATA before touching anything and refuses to proceed on a mismatch, rather than assuming a fixed path — a real, reproduced risk on deployments whose data predates this change.

Source PR (triton repo): all CI checks green, including a new postgres-tde-bootstrap job and a full local redeploy verified against a real production-representative database (186k rows restored from backup, confirmed encrypted and readable post-migration).

License-server has no distribution copy in this repo (per triton's own CLAUDE.md), so nothing to sync there.

Mirrors triton PR #1052 (issue #1050): swaps the bundled Postgres image to `percona/percona-distribution-postgresql:18` (ships pg_tde built in), adds `pg-tde-bootstrap.sh`, and adds an `ensure_pg_tde()` retrofit step to `upgrade.sh` for already-deployed installs. Includes two fixes found while verifying the source PR end-to-end (not present in the source repo's first push, both added before this sync): - The keyring lives as a plain subdirectory of `PGDATA`, not a separate volume — an independently-mounted volume comes back root-owned on real Docker with no way to fix it, since this image runs as a non-root user from its very first process. - `ensure_pg_tde()` discovers the running container's actual `PGDATA` before touching anything and refuses to proceed on a mismatch, rather than assuming a fixed path — a real, reproduced risk on deployments whose data predates this change. Source PR (triton repo): all CI checks green, including a new `postgres-tde-bootstrap` job and a full local redeploy verified against a real production-representative database (186k rows restored from backup, confirmed encrypted and readable post-migration). License-server has no distribution copy in this repo (per `triton`'s own `CLAUDE.md`), so nothing to sync there.

amiryahaya added 2 commits

2026-09-17 15:30:50 +02:00

fix(manage-server): auto-detect gateway hostname on install, warn loudly either way (#956 ) e59e161727

Sync of triton#990. install.sh's own help text claimed
--gateway-hostname "defaults to current FQDN" if omitted, but nothing
actually implemented that -- when the flag wasn't passed,
env.template's literal placeholder "manage.example.com" was left
untouched, with zero warning. That value gets baked into every agent
enrollment bundle and into the gateway's own TLS certificate, so
every downstream agent enrollment silently failed with a certificate
hostname mismatch.

Detect the host's real primary outbound IP at install time via the
kernel's routing table (run on the bare host, before any container
starts, so it correctly sees the host's real network rather than a
container-internal one). Use it as the default instead of the
placeholder, but always print a loud warning telling the operator to
verify it before enrolling any agents.

feat(manage-server): sync pg_tde encryption-at-rest installer changes 1c1b96cd27

Mirrors triton PR #1052 (issue #1050): swaps the bundled Postgres image to
percona/percona-distribution-postgresql:18 (ships pg_tde), adds
pg-tde-bootstrap.sh, and adds an ensure_pg_tde() retrofit step to
upgrade.sh for already-deployed installs — including a PGDATA-mismatch
safety check and a restore-from-backup key-collision fix found while
verifying the source PR end-to-end against real data.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

amiryahaya merged commit aa8ccb988d into main

2026-09-17 15:54:20 +02:00

amiryahaya referenced this pull request from a commit

2026-09-17 15:54:21 +02:00

Merge pull request 'feat(manage-server): sync pg_tde encryption-at-rest installer changes' (#28) from feat/pg-tde-migration into main