From 7d45a4b95d55a722cdbef792dbaf6296be661bf0 Mon Sep 17 00:00:00 2001 From: Tommy Date: Fri, 8 Sep 2023 08:19:50 -0700 Subject: [PATCH] Use Unix socket for PostgreSQL --- README.md | 1 + etc/matrix-synapse/homeserver.yaml | 9 ++++----- etc/postgresql/15/main/conf.d/unix-socket.conf | 7 +++++++ 3 files changed, 12 insertions(+), 5 deletions(-) create mode 100644 etc/postgresql/15/main/conf.d/unix-socket.conf diff --git a/README.md b/README.md index c16191b..20c86b6 100644 --- a/README.md +++ b/README.md @@ -7,6 +7,7 @@ This configuration does not include some hardening configurations, as those are - snap ufw blocks Docker by default. ArcticFoxes's Matrix server uses .deb ufw instead. - A lot of these configuration files use ArcticFoxes's domain. If you are adopting this to your own system, make sure that you replace them. - The Certbot-OCSP-Fetcher script can be found [here](https://github.com/GrapheneOS/infrastructure/blob/main/certbot-ocsp-fetcher) +- You need to create a `postgres-socket` and add the `postgres` and `matrix-synapse` user to it. - Systemd overrides for NGINX and SSHD services are based on [GrapheneOS's configurations](https://github.com/GrapheneOS/infrastructure/tree/main/systemd/system). - Systemd override for Synapse is based on Arch Linux's [matrix-synapse](https://gitlab.archlinux.org/archlinux/packaging/packages/matrix-synapse/-/blob/main/override-hardened.conf?ref_type=heads) package. - The repolists of PostgreSQL and Docker have been modified so that they read GPG keys from `/usr/share/keyring` by default. Make sure that when you follow upstream's documentation on adding their GPG keys, you adjust the location. For PostgreSQL's GPG key, run `curl https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor | sudo tee /usr/share/keyrings/postgresql-debian-repo.gpg >/dev/null` diff --git a/etc/matrix-synapse/homeserver.yaml b/etc/matrix-synapse/homeserver.yaml index 120409f..974b856 100644 --- a/etc/matrix-synapse/homeserver.yaml +++ b/etc/matrix-synapse/homeserver.yaml @@ -25,11 +25,10 @@ listeners: database: name: psycopg2 args: - user: synapse - password: REDACTED - host: 127.0.0.1 - database: synapse - port: 5432 + user: 'synapse' + password: 'REDACTED' + host: '/var/run/postgresql' + database: 'synapse' cp_min: 5 cp_max: 10 log_config: "/etc/matrix-synapse/log.yaml" diff --git a/etc/postgresql/15/main/conf.d/unix-socket.conf b/etc/postgresql/15/main/conf.d/unix-socket.conf new file mode 100644 index 0000000..0d74c2c --- /dev/null +++ b/etc/postgresql/15/main/conf.d/unix-socket.conf @@ -0,0 +1,7 @@ +# Do not listen on IP interfaces +listen_addresses = '' + +unix_socket_directories = '/var/run/postgresql' + +unix_socket_group = 'postgres-socket' # Create new group and add both postgres and matrix-synapse to it +unix_socket_permissions = 0660 \ No newline at end of file