Open postgres to listen on the network and enforce protection with a random password

[stephdl]

These changes improve security by avoiding the use of hardcoded passwords in the service configuration files and allow to open the network tcp port inside the trusted zone

This pull request includes changes to the postgresql-app.service and pgadmin-app.service files to update them to use secrets for the database password. It also adds a new script, create-secrets, for module initialization. The create-secrets script generates a random password for the PostgreSQL user and stores it in a secrets file.

pgadmin connects to the databse on a unix socket

[DavidePrincipi]

Why this change is required? The hardcoded password seems valid only for connections coming from the pod's private network. What are the benefits of this change?

[stephdl]

In fact actually postgresql can be contacted only from the host so I have to install the webserver on the node where is running postgres. I would like to use postgres from any servers inside the cluster

• I need to open the port inside the pod to allow connection not from 127.0.0.1
• I need a more complex password for the postgres user which is the master
• I need to make an upgrade path

[DavidePrincipi]

Isn't user postgres already limited to connect from 127.0.0.1?

https://github.com/NethServer/ns8-postgresql/pull/15/files#diff-b7d23e7e7108b85544eb3542076bd22cf2daed2d8a246be5ea3d0b6ac956bdc7L33

It is the private loopback IP, not the host one.

As alternative to the random password approach, please evaluate the IP-based check.

From podman-run manpage:

• port_handler=rootlesskit: Use rootlesskit for port forwarding. Default. Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually 10.0.2.100.
If the application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined net‐
works.

• port_handler=slirp4netns: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks.

The default of private network should already work

[stephdl]

now we use a unix socket to connect to the databse for pgadmin, no need for a password

However the POSTGRES_PASSWORD is the only environment variable needed by the container, we cannot create it without, we cannot ask to the container to make it randomly itself like mariadb container does.

[DavidePrincipi]

It's an environment file syntax

Suggested change

	/usr/bin/echo "POSTGRES_PASSWORD=$password_postgres" > ~/.config/state/secrets/passwords.secret
	/usr/bin/echo "POSTGRES_PASSWORD=$password_postgres" > ~/.config/state/secrets/passwords.env

[DavidePrincipi]

Is upgrade necessary? Shouldn't existing installations be already hardened?

[stephdl]

Upgrade is necessary to change the postgres password from Nethesis,1234 to a random one

Else you could connect easily you know it

[DavidePrincipi]

What is the firewall command required to open that port? Please, make an example.

[stephdl]

Without tls encryption I am not sure to open a tcp port is smart. I can be wrong