unoverse 0.1.82 → 0.1.84

package/operator/ansible/playbooks/db-setup.yml

@@ -80,6 +80,37 @@
           See docs/runbooks/02-database.md for details.
       when: ext_result.rc != 0
 
+    # BEFORE MIGRATIONS, OR THEY CANNOT CREATE THEIR OWN BOOKKEEPING TABLE. PostgreSQL 15+
+    # dropped the implicit CREATE on schema public, and DigitalOcean creates every database
+    # owned by its admin user, so the universe user connects fine and then fails on the
+    # first CREATE TABLE. Granting is idempotent and only ever widens this one user's rights
+    # inside its own database — it touches nothing else on a shared cluster.
+    #
+    # no_log because the admin connection string is an argument here. It arrives from
+    # terraform at deploy time and is never written to the server.
+    - name: "[3b/5] Grant the universe user rights on its own schema"
+      command: >
+        docker compose exec -T -e NODE_TLS_REJECT_UNAUTHORIZED=0 -e ADMIN_URL={{ pg_admin_url }} unoverse node -e
+        "const{Client}=require('pg');
+        const c=new Client({connectionString:process.env.ADMIN_URL,ssl:{rejectUnauthorized:false}});
+        (async()=>{
+          await c.connect();
+          await c.query('GRANT ALL ON SCHEMA public TO \"universe\"');
+          await c.query('GRANT ALL ON ALL TABLES IN SCHEMA public TO \"universe\"');
+          await c.query('GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO \"universe\"');
+          await c.end();
+          console.log('granted');
+        })().catch(e=>{console.error(e.message);process.exit(1)})"
+      args:
+        chdir: /opt/gravity
+      when: (pg_admin_url | default('')) | length > 0
+      no_log: true
+      register: grant_result
+
+    - name: "[3b/5] Schema rights"
+      debug:
+        msg: "{{ 'universe may create objects in its database' if (pg_admin_url | default('')) | length > 0 else 'skipped — bring-your-own database, permissions are yours' }}"
+
     # Apply the .sql migrations with node-pg-migrate — same as `./unoverse db-setup`
     # (scripts/lib/db-setup.sh). The old programmatic `require('./dist/db')` table
     # setup is retired: the engine no longer ships a dist, and .sql migrations under

package/operator/infra/digitalocean/outputs.tf

@@ -12,6 +12,19 @@ locals {
   pg_pooled = local.pg_managed ? "postgresql://${digitalocean_database_user.universe[0].name}:${digitalocean_database_user.universe[0].password}@${digitalocean_database_connection_pool.universe[0].private_host}:${digitalocean_database_connection_pool.universe[0].port}/${digitalocean_database_connection_pool.universe[0].name}?sslmode=require&pgbouncer=true" : var.byo_postgres_url
   pg_direct = local.pg_managed ? "postgresql://${digitalocean_database_user.universe[0].name}:${digitalocean_database_user.universe[0].password}@${local.pg_cluster_host}:${local.pg_cluster_port}/${digitalocean_database_db.universe[0].name}?sslmode=require" : var.byo_postgres_url
 
+  # THE ADMIN URL EXISTS FOR EXACTLY ONE STATEMENT. PostgreSQL 15+ no longer grants CREATE
+  # on schema public to PUBLIC, and DigitalOcean owns every database it creates as doadmin.
+  # So the universe user can connect and can create nothing: the first migration dies on
+  # "permission denied for schema public" after the extensions step reports OK, which reads
+  # like the database is fine. Only the cluster's admin can hand over those rights.
+  #
+  # It is a separate output and NOT part of env_production on purpose. The server holds the
+  # universe user's credentials and must never hold the cluster admin's — deploy reads this,
+  # spends it on one GRANT, and it goes no further.
+  pg_admin_user = local.pg_adopt ? data.digitalocean_database_cluster.existing_pg[0].user : (local.provision_pg ? digitalocean_database_cluster.pg[0].user : "")
+  pg_admin_pass = local.pg_adopt ? data.digitalocean_database_cluster.existing_pg[0].password : (local.provision_pg ? digitalocean_database_cluster.pg[0].password : "")
+  pg_admin_url = local.pg_managed ? "postgresql://${local.pg_admin_user}:${local.pg_admin_pass}@${local.pg_cluster_host}:${local.pg_cluster_port}/${digitalocean_database_db.universe[0].name}?sslmode=require" : ""
+
   # Redis is always ours — provisioned above, no BYO branch.
   redis_host     = digitalocean_database_cluster.redis.private_host
   redis_port     = digitalocean_database_cluster.redis.port
@@ -39,6 +52,14 @@ output "api_url" {
   value       = local.has_domain ? "https://${local.api_host}" : "http://${digitalocean_loadbalancer.public.ip}"
 }
 
+# Read by deploy for the one-time schema grant, never written to the server. Empty when
+# the database is BYO: somebody else's cluster, whose permissions are theirs to run.
+output "pg_admin_url" {
+  value       = local.pg_admin_url
+  description = "Cluster admin connection to this universe's database — used once, to grant the universe user rights on schema public"
+  sensitive   = true
+}
+
 output "env_production" {
   sensitive   = true
   description = "Rendered .env.production — complete, write to a file and deploy"

package/operator/lib/deploy.sh

@@ -363,6 +363,13 @@ cmd_deploy() {
 
   _adopted_db_access "$cloud" grant
 
+  # The cluster admin connection, held in this shell and nowhere else. db-setup spends it
+  # on a single GRANT so the universe user can create objects in its own database; it is
+  # never written to the server, and an empty value (BYO database, or a ground without the
+  # output) simply skips that step.
+  local pg_admin_url
+  pg_admin_url=$(terraform -chdir="$ROOT/infra/$cloud" output -raw pg_admin_url 2>/dev/null)
+
 
   # Read the deploy target from the rendered settings
   local deploy_host deploy_user
@@ -429,11 +436,17 @@ EOF
   # install.yml creates. The remedy was to know that `unoverse deploy init` exists, which
   # is exactly the kind of knowledge this CLI is supposed to remove: deploy owns the whole
   # journey, so it asks the server what it is and picks the right playbook itself.
+  # THE MARKER IS "SETUP FINISHED", NOT "A DIRECTORY EXISTS". Testing for /opt/gravity
+  # looked right and was not: install.yml creates that directory as its seventh task, so a
+  # first-time setup that then FAILED at the database step still left it behind. The next
+  # deploy saw it, decided the server was ready, shipped images onto a database that had
+  # never been migrated, and reported success. The stamp is written only after install,
+  # database and verify have all passed, so an interrupted setup resumes as a setup.
   if [ -z "$subcommand" ]; then
     if ! ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=15 \
-         "$deploy_user@$deploy_host" 'test -d /opt/gravity' >/dev/null 2>&1; then
+         "$deploy_user@$deploy_host" 'test -f /opt/gravity/.setup-complete' >/dev/null 2>&1; then
       echo ""
-      info "New server. Running the full first-time setup ${DIM}(install, database, verify)${NC}"
+      info "This server's setup has not finished. Running it ${DIM}(install, database, verify)${NC}"
       subcommand="init"
     fi
   fi
@@ -470,6 +483,7 @@ EOF
         -i "$tmp_inventory" \
         "$ansible_dir/playbooks/db-setup.yml" \
         -e "universe_root=$ROOT" \
+        -e "pg_admin_url=$pg_admin_url" \
         -e "env_file=$env_prod" || { rm -f "$tmp_inventory"; fail "db setup failed — fix and re-run: unoverse deploy db"; exit 1; }
       echo ""
       info "[3/3] Verifying..."
@@ -478,6 +492,9 @@ EOF
         "$ansible_dir/playbooks/test-connectivity.yml" \
         -e "universe_root=$ROOT" \
         -e "env_file=$env_prod" || { rm -f "$tmp_inventory"; fail "verification failed — inspect and re-run: unoverse deploy test"; exit 1; }
+      # Only now. Every step passed, so the next deploy can safely be an image push.
+      ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=15 \
+        "$deploy_user@$deploy_host" 'touch /opt/gravity/.setup-complete' >/dev/null 2>&1
       echo ""
       ok "Your universe is up. From now on, deploys are just: unoverse deploy"
       info "Keeping it? Harden the VM when you're ready: unoverse deploy harden"
@@ -489,6 +506,7 @@ EOF
         -i "$tmp_inventory" \
         "$ansible_dir/playbooks/db-setup.yml" \
         -e "universe_root=$ROOT" \
+        -e "pg_admin_url=$pg_admin_url" \
         -e "env_file=$env_prod"
       ;;
     test|check)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.82",
+  "version": "0.1.84",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",