Change what Rowsafe may do on a server

Some of what Rowsafe does on your server needs root: restarting PostgreSQL, installing updates, rebooting, managing PgBouncer or the firewall. Rowsafe does these only when someone clicks them in the dashboard and confirms, and only the ones root allowed on that server. Nothing is allowed until root says so, and only root on the server can change it.

The examples use a server named db-1.

When you install

On a terminal, the installer asks once, under one heading, then shows what is allowed:

==> What may Rowsafe do on this server?
    Rowsafe only does these when someone clicks them in your dashboard and
    confirms. You can change them any time with `sudo rowsafe-allow`.
Restart or stop PostgreSQL, when someone clicks Restart or Rewind? [Y/n]
Create a new PostgreSQL cluster here (ports 5440-5499), when someone forks a database to this server? [Y/n]
Install PostgreSQL updates and upgrades, when someone clicks Update? A Mark is saved first. [Y/n]
Install this server's security updates, when someone clicks Install? [y/N] y
Reboot this server, when someone clicks Reboot? A Mark is saved first. [y/N]
Install and manage PgBouncer (connection pooling), when someone turns pooling on? Nothing is installed now. [Y/n]
Limit who can reach PostgreSQL (port 5432) with the firewall, when someone picks the addresses? SSH and other ports are never touched. [y/N]

==> What Rowsafe may do on db-1, only when someone clicks it and confirms
    allowed      restart           restart or stop PostgreSQL (Restart, Rewind)
    allowed      create-cluster    create a PostgreSQL cluster for a fork
    allowed      updates           install PostgreSQL updates and upgrades
    allowed      security-updates  install this server's security updates
    allowed      pooler            install and manage PgBouncer (pooling)
    not allowed  reboot            reboot this server (after an update)
    not allowed  pooler-public     let PgBouncer listen on public addresses
    not allowed  firewall          limit who can reach PostgreSQL (firewall)
    Allow one:          sudo rowsafe-allow reboot
    Stop allowing one:  sudo rowsafe-allow --remove restart

The installer only asks what applies to the server: no firewall question without nftables, no reboot question unless you allowed security updates. Running it again keeps your answers and asks only about what is new. Without a terminal it asks nothing (pass the options instead), and still shows what is allowed.

See and change it later

On the server, as root:

sudo rowsafe-allow                            # what Rowsafe may do here
sudo rowsafe-allow restart security-updates   # allow these
sudo rowsafe-allow --remove reboot            # stop allowing this

Each change takes a few seconds, prints what Rowsafe may do now, and the agent reports it to Rowsafe within a minute. It changes nothing else: the agent, its settings, backups and your databases stay as they are, and nothing is downloaded.

What one needs, you allow together. sudo rowsafe-allow reboot on a server without security updates allowed changes nothing and tells you the command: sudo rowsafe-allow security-updates reboot. Turning one off turns off what needs it: sudo rowsafe-allow --remove restart also stops updates, security updates, reboots and new clusters.

A permission the server can't have is listed as unavailable, with why: for example the firewall without nftables (apt install nftables, then sudo rowsafe-allow firewall), or new clusters without Debian's pg_createcluster.

Folders with uploads are allowed one by one: sudo rowsafe-allow --files /var/www/uploads backs the folder up with its database and lets Rowsafe put restored files back there (this runs the whole installer again, on the installed version); sudo rowsafe-allow --remove files stops putting files back. See Files.

Install options

The installer's options answer the questions without asking:

curl -fsSL https://rowsafe.sh | sudo sh -s -- --allow-restart --allow-updates --no-allow-firewall

Each name has --allow-NAME and --no-allow-NAME. See the installer reference.

For configuration management, the installer's permissions-only mode does exactly what sudo rowsafe-allow does, without a terminal and without the network:

sudo /usr/local/lib/rowsafe/install.sh --permissions --no-prompt --allow-restart --no-allow-reboot

It exits with 0 when done (or nothing to change), 2 when it refused and changed nothing (a needed permission missing, not possible on this server, Rowsafe not installed), and 1 when something failed while changing. Its last lines are what Rowsafe may do now, then the reason when it refused or failed.

Limits

• Root decides, on the server. rowsafe-allow needs sudo. Rowsafe's API and AI agents can't change what is allowed, and the dashboard only will with a passkey root paired at the server (see above).
• Servers installed before rowsafe-allow don't have it yet: a self-updated agent doesn't add it. Run the install command once more (curl -fsSL https://rowsafe.sh | sudo sh): it keeps your answers and adds rowsafe-allow. Until then, the options work as before.
• PostgreSQL only. On a server with only MySQL, MariaDB or MongoDB there is nothing to allow yet.
• Docker. These permissions are for servers where Rowsafe runs as a service. In Docker, what the agent may do is set where its containers are defined: see Docker.

Files on the server