Skip to content

chore: disable track_utility before statements with passwords #2378

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
imor wants to merge 3 commits into from
+10 −4
Closed

chore: disable track_utility before statements with passwords #2378

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ddaad5a
chore: disable track_utility before statements with passwords
imor Aug 19, 2026
0a7aa75
chore: bump AMI versions
imor Aug 19, 2026
236be4c
Merge branch 'develop' into rs/pg_stat_statements_reset
imor Aug 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 8 additions & 4 deletions migrations/db/migrate.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,34 +29,38 @@ fi
db=$(cd -- "$(dirname -- "$0")" >/dev/null 2>&1 && pwd)
if [ -z "${USE_DBMATE:-}" ]; then
psql -v ON_ERROR_STOP=1 --no-password --no-psqlrc -U supabase_admin <<EOSQL
set pg_stat_statements.track_utility = off;
do \$\$
begin
-- postgres role is pre-created during AMI build
if not exists (select from pg_roles where rolname = 'postgres') then
create role postgres superuser login password '$PGPASSWORD';
alter database postgres owner to postgres;
end if;
end \$\$
end \$\$;
reset pg_stat_statements.track_utility;
EOSQL
# run init scripts as postgres user
for sql in "$db"/init-scripts/*.sql; do
echo "$0: running $sql"
psql -v ON_ERROR_STOP=1 --no-password --no-psqlrc -U postgres -f "$sql"
done
psql -v ON_ERROR_STOP=1 --no-password --no-psqlrc -U postgres -c "ALTER USER supabase_admin WITH PASSWORD '$PGPASSWORD'"
psql -v ON_ERROR_STOP=1 --no-password --no-psqlrc -U postgres -c "SET pg_stat_statements.track_utility = off; ALTER USER supabase_admin WITH PASSWORD '$PGPASSWORD'; RESET pg_stat_statements.track_utility;"
# run migrations as super user - postgres user demoted in post-setup
for sql in "$db"/migrations/*.sql; do
echo "$0: running $sql"
psql -v ON_ERROR_STOP=1 --no-password --no-psqlrc -U supabase_admin -f "$sql"
done
else
psql -v ON_ERROR_STOP=1 --no-password --no-psqlrc -U supabase_admin <<EOSQL
set pg_stat_statements.track_utility = off;
create role postgres superuser login password '$PGPASSWORD';
alter database postgres owner to postgres;
reset pg_stat_statements.track_utility;
EOSQL
# run init scripts as postgres user
DBMATE_MIGRATIONS_DIR="$db/init-scripts" DATABASE_URL="postgres://postgres:$connect" dbmate --no-dump-schema migrate
psql -v ON_ERROR_STOP=1 --no-password --no-psqlrc -U postgres -c "ALTER USER supabase_admin WITH PASSWORD '$PGPASSWORD'"
psql -v ON_ERROR_STOP=1 --no-password --no-psqlrc -U postgres -c "SET pg_stat_statements.track_utility = off; ALTER USER supabase_admin WITH PASSWORD '$PGPASSWORD'; RESET pg_stat_statements.track_utility;"
# run migrations as super user - postgres user demoted in post-setup
DBMATE_MIGRATIONS_DIR="$db/migrations" DATABASE_URL="postgres://supabase_admin:$connect" dbmate --no-dump-schema migrate
fi
Expand All @@ -65,7 +69,7 @@ fi
postinit="/etc/postgresql.schema.sql"
if [ -e "$postinit" ]; then
echo "$0: running $postinit"
psql -v ON_ERROR_STOP=1 --no-password --no-psqlrc -U supabase_admin -f "$postinit"
psql -v ON_ERROR_STOP=1 --no-password --no-psqlrc -U supabase_admin -c "SET pg_stat_statements.track_utility = off;" -f "$postinit" -c "RESET pg_stat_statements.track_utility;"
fi

# once done with everything, reset stats from init
Expand Down
2 changes: 2 additions & 0 deletions nix/tools/postgresql_schema.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
ALTER DATABASE postgres SET "app.settings.jwt_secret" TO 'my_jwt_secret_which_is_not_so_secret';
ALTER DATABASE postgres SET "app.settings.jwt_exp" TO 3600;
SET pg_stat_statements.track_utility = off;
ALTER USER supabase_admin WITH PASSWORD 'postgres';
ALTER USER postgres WITH PASSWORD 'postgres';
ALTER USER authenticator WITH PASSWORD 'postgres';
Expand All @@ -9,4 +10,5 @@ ALTER USER supabase_storage_admin WITH PASSWORD 'postgres';
ALTER USER supabase_replication_admin WITH PASSWORD 'postgres';
ALTER USER supabase_etl_admin WITH PASSWORD 'postgres';
ALTER ROLE supabase_read_only_user WITH PASSWORD 'postgres';
RESET pg_stat_statements.track_utility;
ALTER ROLE supabase_admin SET search_path TO "$user",public,auth,extensions;
Loading