Prepare PostgreSQL and secret wiring for Attic

nimmo commented

2026-07-01 16:14:27 +01:00

Owner

Goal

Prepare the PostgreSQL-backed Attic metadata path before introducing a second Attic node.

Scope

This issue covers the preparatory work from projects/attic-postgres-lyra-rollout.md Phase 1.

Acceptance Checklist

Create a dedicated PostgreSQL role for Attic.
Create a dedicated PostgreSQL database for Attic.
Permit database access from the Attic hosts that need it.
Store the Attic database connection string in SOPS rather than plain Nix.
Update the Attic module so the database URL comes from secret-backed configuration.

Implementation Outline

Create the PostgreSQL role and database.
Add a SOPS secret for the Attic database URL.
Update modules/services/atticd.nix to read database.url from that secret-backed source.
Keep the NAS-backed storage unchanged at this stage.

Verification

psql 'postgres://atticd:...@<postgres-host>:5432/attic' -c '\dt'

Success means the credentials work and the database is reachable from the Attic host.

Notes

Do not deploy Attic on lyra before this is done.
Treat this as a migration prerequisite rather than the migration itself.

## Goal Prepare the PostgreSQL-backed Attic metadata path before introducing a second Attic node. ## Scope This issue covers the preparatory work from `projects/attic-postgres-lyra-rollout.md` Phase 1. ## Acceptance Checklist - Create a dedicated PostgreSQL role for Attic. - Create a dedicated PostgreSQL database for Attic. - Permit database access from the Attic hosts that need it. - Store the Attic database connection string in SOPS rather than plain Nix. - Update the Attic module so the database URL comes from secret-backed configuration. ## Implementation Outline 1. Create the PostgreSQL role and database. 2. Add a SOPS secret for the Attic database URL. 3. Update `modules/services/atticd.nix` to read `database.url` from that secret-backed source. 4. Keep the NAS-backed storage unchanged at this stage. ## Verification ```bash psql 'postgres://atticd:...@<postgres-host>:5432/attic' -c '\dt' ``` Success means the credentials work and the database is reachable from the Attic host. ## Notes - Do not deploy Attic on `lyra` before this is done. - Treat this as a migration prerequisite rather than the migration itself.

nimmo added this to the Attic PostgreSQL Migration and Lyra Rollout milestone

2026-07-01 16:14:27 +01:00

nimmo added the

host:fleet

project:attic-postgres-lyra-rollout

labels

2026-07-01 16:14:27 +01:00

nimmo commented

2026-07-06 14:35:52 +01:00

Author

Owner

Progress update:

Added secret-backed Attic wiring in modules/services/atticd.nix.
The module now reads attic/token/rs256_secret_base64 and attic/database/url from secrets/attic.yaml via SOPS.
Removed the hardcoded SQLite database.url from the Nix config and now inject ATTIC_SERVER_DATABASE_URL through the service environment.
Updated secrets/README.md to document the new Attic secret layout.
nix flake check passed after the wiring change.

Remaining work for this issue is the live PostgreSQL side:

create the PostgreSQL role/database
set the real DB URL secret value
verify connectivity from the Attic host

Progress update: - Added secret-backed Attic wiring in `modules/services/atticd.nix`. - The module now reads `attic/token/rs256_secret_base64` and `attic/database/url` from `secrets/attic.yaml` via SOPS. - Removed the hardcoded SQLite `database.url` from the Nix config and now inject `ATTIC_SERVER_DATABASE_URL` through the service environment. - Updated `secrets/README.md` to document the new Attic secret layout. - `nix flake check` passed after the wiring change. Remaining work for this issue is the live PostgreSQL side: - create the PostgreSQL role/database - set the real DB URL secret value - verify connectivity from the Attic host

nimmo commented

2026-07-06 14:47:37 +01:00

Author

Owner

Further progress update:

Tested the Attic secret-wiring change on vega with a remote staged deploy:
- rsync -a --delete --exclude=.git ./ nimmo@vega:~/nixos-staging/
- ssh -t nimmo@vega 'sudo nixos-rebuild test --flake /home/nimmo/nixos-staging#vega'
The test activation succeeded.
sops-install-secrets added atticd-database-url and updated the rendered atticd-env secret template during activation.
This confirms the secret path and service-environment wiring work on the target host.

What remains for this issue:

create the PostgreSQL role/database
set the real PostgreSQL URL in secrets/attic.yaml
verify Attic can reach that database from vega

Further progress update: - Tested the Attic secret-wiring change on `vega` with a remote staged deploy: - `rsync -a --delete --exclude=.git ./ nimmo@vega:~/nixos-staging/` - `ssh -t nimmo@vega 'sudo nixos-rebuild test --flake /home/nimmo/nixos-staging#vega'` - The test activation succeeded. - `sops-install-secrets` added `atticd-database-url` and updated the rendered `atticd-env` secret template during activation. - This confirms the secret path and service-environment wiring work on the target host. What remains for this issue: - create the PostgreSQL role/database - set the real PostgreSQL URL in `secrets/attic.yaml` - verify Attic can reach that database from `vega`

nimmo commented

2026-07-06 14:54:18 +01:00

Author

Owner

Connectivity progress update:

Verified basic PostgreSQL reachability from vega to nova.mesh using a one-off psql invocation via nix shell nixpkgs#postgresql.
The check connected successfully and returned Did not find any relations., which is consistent with an empty database before Attic creates its tables.

Remaining note for final acceptance:

Re-run the verification using the actual Attic database URL/credentials from attic/database/url so the issue is validated with the exact service identity, not just a general PostgreSQL login.

Connectivity progress update: - Verified basic PostgreSQL reachability from `vega` to `nova.mesh` using a one-off `psql` invocation via `nix shell nixpkgs#postgresql`. - The check connected successfully and returned `Did not find any relations.`, which is consistent with an empty database before Attic creates its tables. Remaining note for final acceptance: - Re-run the verification using the actual Attic database URL/credentials from `attic/database/url` so the issue is validated with the exact service identity, not just a general PostgreSQL login.

nimmo commented

2026-07-06 14:55:52 +01:00

Author

Owner

Final validation update:

Confirmed PostgreSQL connectivity from vega using the real Attic database credentials (redacted in terminal transcript) via a one-off psql check.
The connection succeeded and returned Did not find any relations., which is expected for a newly created empty database before Attic initializes schema.

This completes the scope of this issue:

PostgreSQL/database secret wiring is in place
vega test activation succeeded with the new secret-backed environment
the target database is reachable from the Attic host using the actual service credentials

Final validation update: - Confirmed PostgreSQL connectivity from `vega` using the real Attic database credentials (redacted in terminal transcript) via a one-off `psql` check. - The connection succeeded and returned `Did not find any relations.`, which is expected for a newly created empty database before Attic initializes schema. This completes the scope of this issue: - PostgreSQL/database secret wiring is in place - `vega` test activation succeeded with the new secret-backed environment - the target database is reachable from the Attic host using the actual service credentials

nimmo closed this issue

2026-07-06 14:55:55 +01:00

Rows
Columns

Prepare PostgreSQL and secret wiring for Attic #5

Goal

Scope

Acceptance Checklist

Implementation Outline

Verification

Notes