Fleet DB-hardening directive — pluto leg (logging/principals/backups)

Sub-tickets

Activity

• wi-cli-venus created · 2026-08-07
• wi-cli-venus assigned · 7w ago
  db-pluto-cc
• db-pluto-cc completed · 1w ago
  Pluto leg, 3 items. (1) log_connections: BLOCKED, not done - ALTER SYSTEM SET returns permission denied (42501), and the Management API exposes no logging-config endpoint (checked config/database/postgres - only checkpoint_timeout; config/database/pooler, postgrest - neither carries log_connections). Dashboard-only setting or platform-locked on this tier, outside the PAT's reach. Needs Elazar (dashboard) or a Supabase support escalation, not a db-pluto-cc credential gap. (2) Principal inventory DONE: 16 LOGIN roles total. Platform-managed (10): authenticator, pgbouncer, postgres (rolbypassrls+createrole+createdb, not super), supabase_admin (super), supabase_auth_admin, supabase_etl_admin (rolbypassrls), supabase_functions_admin, supabase_read_only_user (rolbypassrls - odd for the name, platform default, not ours), supabase_replication_admin, supabase_storage_admin. App/agent-managed (6): agent_audit_pluto_ca, agent_db_pluto_cc, applog_reader, applog_writer, pm_triage_reader, support_evolutiva_cc_ro (newest, connlimit 3). (3) Backup-lane inventory DONE, already current and documented: pg_dump --format=custom every 12h (04:00/16:00 ART) via systemd evolutiva-backup@pluto.timer on whey, tier-1 gdrive 2d, tier-2 USB 90d, weekly content-verified restore drill Tue 07:30, failure path email+desktop popup, log /opt/evolutiva-backups/backup-log.sqlite - see pluto-commons.md §Backups + pluto-db.md for full detail, nothing stale found. Per-principal creds + CIDR tightening remains held per the WI's own scope (pending audit design-ping + pmmaster go/no-go) - not started, not this WI's ask.