feat(roles): add role management to menu and improve security

init/generate.sh

@@ -16,6 +16,10 @@ cat > "$WARMUP" <<- VersCheck
   select 1/0;
 \endif
 
+select current_setting('server_version_num')::integer >= 170000 as postgres_dba_pgvers_17plus \gset
+
+select current_setting('server_version_num')::integer >= 130000 as postgres_dba_pgvers_13plus \gset
+
 select current_setting('server_version_num')::integer >= 100000 as postgres_dba_pgvers_10plus \gset
 \if :postgres_dba_pgvers_10plus
   \set postgres_dba_last_wal_receive_lsn pg_last_wal_receive_lsn

roles/alter_user_with_random_password.psql

@@ -43,17 +43,17 @@ begin
     j := int4(random() * allowed_len);
     pwd := pwd || substr(allowed, j+1, 1);
   end loop;
-  sql := 'alter role ' || current_setting('postgres_dba.username')::text || ' password ''' || pwd || ''';';
+  sql := format('alter role %I password %L', current_setting('postgres_dba.username')::text, pwd);
   raise debug 'SQL: %', sql;
   execute sql;
-  sql := 'alter role ' || current_setting('postgres_dba.username')::text
-    || (case when lower(current_setting('postgres_dba.is_superuser')::text) not in ('0', '', 'no', 'false', 'n', 'f') then ' superuser' else '' end)
-    || ';';
+  sql := format('alter role %I%s', 
+    current_setting('postgres_dba.username')::text,
+    (case when lower(current_setting('postgres_dba.is_superuser')::text) not in ('0', '', 'no', 'false', 'n', 'f') then ' superuser' else '' end));
   raise debug 'SQL: %', sql;
   execute sql;
-  sql := 'alter role ' || current_setting('postgres_dba.username')::text
-    || (case when lower(current_setting('postgres_dba.login')::text) not in ('0', '', 'no', 'false', 'n', 'f') then ' login' else '' end)
-    || ';';
+  sql := format('alter role %I%s', 
+    current_setting('postgres_dba.username')::text,
+    (case when lower(current_setting('postgres_dba.login')::text) not in ('0', '', 'no', 'false', 'n', 'f') then ' login' else '' end));
   raise debug 'SQL: %', sql;
   execute sql;
   raise debug 'User % altered, password: %', current_setting('postgres_dba.username')::text, pwd;

roles/create_user_with_random_password.psql

@@ -43,10 +43,11 @@ begin
     j := int4(random() * allowed_len);
     pwd := pwd || substr(allowed, j+1, 1);
   end loop;
-  sql := 'create role ' || current_setting('postgres_dba.username')::text
-    || (case when lower(current_setting('postgres_dba.is_superuser')::text) not in ('0', '', 'no', 'false', 'n', 'f') then ' superuser' else '' end)
-    || (case when lower(current_setting('postgres_dba.login')::text) not in ('0', '', 'no', 'false', 'n', 'f') then ' login' else '' end)
-    || ' password ''' || pwd || ''';';
+  sql := format('create role %I%s%s password %L', 
+    current_setting('postgres_dba.username')::text,
+    (case when lower(current_setting('postgres_dba.is_superuser')::text) not in ('0', '', 'no', 'false', 'n', 'f') then ' superuser' else '' end),
+    (case when lower(current_setting('postgres_dba.login')::text) not in ('0', '', 'no', 'false', 'n', 'f') then ' login' else '' end),
+    pwd);
   raise debug 'SQL: %', sql;
   execute sql;
   raise info 'User % created, password: %', current_setting('postgres_dba.username')::text, pwd;

sql/0_node.sql

@@ -1,4 +1,4 @@
---Node & current DB information: master/replica, lag, DB size, tmp files, etc.
+--Node and current database information: primary/replica, lag, database size, temporary files, etc.
 
 /*
 For Postgres versions older than 10, run this first:

sql/a1_activity.sql

@@ -1,4 +1,4 @@
---Current activity: count of current connections grouped by database, user name, state
+--Current activity: count of current connections grouped by database, username, state
 select
   coalesce(usename, '** ALL users **') as "User",
   coalesce(datname, '** ALL databases **') as "DB",

sql/e1_extensions.sql

@@ -1,4 +1,4 @@
---Extensions installed in current DB
+--Extensions installed in current database
 
 select
   ae.name,

sql/i3_non_indexed_fks.sql

@@ -1,4 +1,4 @@
---FKs with Missing/Bad Indexes
+--Foreign keys with missing or bad indexes
 
 --Created by PostgreSQL Experts https://github.com/pgexperts/pgx_scripts/blob/master/indexes/fk_no_index.sql
 

sql/l1_lock_trees.sql

@@ -1,4 +1,4 @@
---Lock trees (leightweight)
+--Lock trees (lightweight)
 
 -- Source: https://github.com/dataegret/pg-utils/blob/master/sql/locktree.sql
 -- The paths won't be precise but this query is very light and may be used quite frequently

sql/r1_create_user_with_random_password.sql

@@ -0,0 +1,2 @@
+--Create user with random password (interactive)
+\ir ../roles/create_user_with_random_password.psql

sql/r2_alter_user_with_random_password.sql

@@ -0,0 +1,2 @@
+--Alter user with random password (interactive)
+\ir ../roles/alter_user_with_random_password.psql

sql/t1_tuning.sql

@@ -42,7 +42,7 @@ select :postgres_dba_t1_location = 3 as postgres_dba_t1_location_rds \gset
 
 \echo
 \echo
-\echo 'Type total available memory (in GB): '
+\echo 'Type total available memory (in GiB): '
 \prompt postgres_dba_t1_memory
 
 \echo

sql/v2_autovacuum_progress_and_queue.sql

@@ -1,4 +1,4 @@
---Vacuum: VACUUM progress and autovacuum queue
+--VACUUM progress and autovacuum queue
 
 -- Based on: https://gitlab.com/snippets/1889668
 

start.psql

@@ -1,29 +1,31 @@
 \ir warmup.psql
 \echo '\033[1;35mMenu:\033[0m'
-\echo '   0 – Node & current DB information: master/replica, lag, DB size, tmp files, etc.'
+\echo '   0 – Node and current database information: primary/replica, lag, database size, temporary files, etc.'
 \echo '   1 – Databases: size, stats'
 \echo '   2 – Tables: table/index/TOAST size, number of rows'
 \echo '   3 – Load profile'
-\echo '  a1 – Current activity: count of current connections grouped by database, user name, state'
+\echo '  a1 – Current activity: count of current connections grouped by database, username, state'
 \echo '  b1 – Table bloat (estimated)'
 \echo '  b2 – B-tree index bloat (estimated)'
 \echo '  b3 – Table bloat (requires pgstattuple; expensive)'
 \echo '  b4 – B-tree indexes bloat (requires pgstattuple; expensive)'
 \echo '  b5 – Tables and columns without stats (so bloat cannot be estimated)'
-\echo '  e1 – Extensions installed in current DB'
+\echo '  e1 – Extensions installed in current database'
 \echo '  i1 – Unused and rarely used indexes'
 \echo '  i2 – Redundant indexes'
-\echo '  i3 – FKs with Missing/Bad Indexes'
+\echo '  i3 – Foreign keys with missing or bad indexes'
 \echo '  i4 – Invalid indexes'
 \echo '  i5 – Cleanup unused and redundant indexes – DO & UNDO migration DDL'
-\echo '  l1 – Lock trees (leightweight)'
+\echo '  l1 – Lock trees (lightweight)'
 \echo '  l2 – Lock trees, detailed (based on pg_blocking_pids())'
 \echo '  p1 – [EXP] Alignment padding: how many bytes can be saved if columns are reordered?'
+\echo '  r1 – Create user with random password (interactive)'
+\echo '  r2 – Alter user with random password (interactive)'
 \echo '  s1 – Slowest queries, by total time (requires pg_stat_statements)'
 \echo '  s2 – Slowest queries report (requires pg_stat_statements)'
 \echo '  t1 – Postgres parameters tuning'
 \echo '  v1 – Vacuum: current activity'
-\echo '  v2 – Vacuum: VACUUM progress and autovacuum queue'
+\echo '  v2 – VACUUM progress and autovacuum queue'
 \echo '   q – Quit'
 \echo
 \echo Type your choice and press <Enter>:
@@ -49,6 +51,8 @@ select
 :d_stp::text = 'l1' as d_step_is_l1,
 :d_stp::text = 'l2' as d_step_is_l2,
 :d_stp::text = 'p1' as d_step_is_p1,
+:d_stp::text = 'r1' as d_step_is_r1,
+:d_stp::text = 'r2' as d_step_is_r2,
 :d_stp::text = 's1' as d_step_is_s1,
 :d_stp::text = 's2' as d_step_is_s2,
 :d_stp::text = 't1' as d_step_is_t1,
@@ -134,6 +138,14 @@ select
   \ir ./sql/p1_alignment_padding.sql
   \prompt 'Press <Enter> to continue…' d_dummy
   \ir ./start.psql
+\elif :d_step_is_r1
+  \ir ./sql/r1_create_user_with_random_password.sql
+  \prompt 'Press <Enter> to continue…' d_dummy
+  \ir ./start.psql
+\elif :d_step_is_r2
+  \ir ./sql/r2_alter_user_with_random_password.sql
+  \prompt 'Press <Enter> to continue…' d_dummy
+  \ir ./start.psql
 \elif :d_step_is_s1
   \ir ./sql/s1_pg_stat_statements_top_total.sql
   \prompt 'Press <Enter> to continue…' d_dummy