Support for setting a custom database name. Closes #936

constants/env.go

@@ -5,6 +5,7 @@ const (
 	EnvUpdateCheck      = "STEAMPIPE_UPDATE_CHECK"
 	EnvInstallDir       = "STEAMPIPE_INSTALL_DIR"
 	EnvConnectionString = "STEAMPIPE_CONNECTION_STRING"
+	EnvInstallDatabase  = "STEAMPIPE_INSTALL_DATABASE"
 	EnvDatabase         = "STEAMPIPE_DATABASE"
 	EnvAPIKey           = "STEAMPIPE_API_KEY"
 	EnvServicePassword  = "STEAMPIPE_DATABASE_PASSWORD"

constants/pg_hba.go

@@ -1,107 +1,33 @@
 package constants
 
-const PgHbaContent = `
+var MinimalPgHbaContent string = `
+hostssl all root samehost trust
+host all root samehost trust
+`
+
+// PgHbaTemplate is to be formatted with two variables:
+// 		* databaseName
+//		* username
+//
+// Example:
+//		fmt.Sprintf(template, datName, username)
+var PgHbaTemplate string = `
 # PostgreSQL Client Authentication Configuration File
 # ===================================================
-#
-# Refer to the "Client Authentication" section in the PostgreSQL
-# documentation for a complete description of this file.  A short
-# synopsis follows.
-#
-# This file controls: which hosts are allowed to connect, how clients
-# are authenticated, which PostgreSQL user names they can use, which
-# databases they can access.  Records take one of these forms:
-#
-# local      DATABASE  USER  METHOD  [OPTIONS]
-# host       DATABASE  USER  ADDRESS  METHOD  [OPTIONS]
-# hostssl    DATABASE  USER  ADDRESS  METHOD  [OPTIONS]
-# hostnossl  DATABASE  USER  ADDRESS  METHOD  [OPTIONS]
-#
-# (The uppercase items must be replaced by actual values.)
-#
-# The first field is the connection type: "local" is a Unix-domain
-# socket, "host" is either a plain or SSL-encrypted TCP/IP socket,
-# "hostssl" is an SSL-encrypted TCP/IP socket, and "hostnossl" is a
-# plain TCP/IP socket.
-#
-# DATABASE can be "all", "sameuser", "samerole", "replication", a
-# database name, or a comma-separated list thereof. The "all"
-# keyword does not match "replication". Access to replication
-# must be enabled in a separate record (see example below).
-#
-# USER can be "all", a user name, a group name prefixed with "+", or a
-# comma-separated list thereof.  In both the DATABASE and USER fields
-# you can also write a file name prefixed with "@" to include names
-# from a separate file.
-#
-# ADDRESS specifies the set of hosts the record matches.  It can be a
-# host name, or it is made up of an IP address and a CIDR mask that is
-# an integer (between 0 and 32 (IPv4) or 128 (IPv6) inclusive) that
-# specifies the number of significant bits in the mask.  A host name
-# that starts with a dot (.) matches a suffix of the actual host name.
-# Alternatively, you can write an IP address and netmask in separate
-# columns to specify the set of hosts.  Instead of a CIDR-address, you
-# can write "samehost" to match any of the server's own IP addresses,
-# or "samenet" to match any address in any subnet that the server is
-# directly connected to.
-#
-# METHOD can be "trust", "reject", "md5", "password", "scram-sha-256",
-# "gss", "sspi", "ident", "peer", "pam", "ldap", "radius" or "cert".
-# Note that "password" sends passwords in clear text; "md5" or
-# "scram-sha-256" are preferred since they send encrypted passwords.
-#
-# OPTIONS are a set of options for the authentication in the format
-# NAME=VALUE.  The available options depend on the different
-# authentication methods -- refer to the "Client Authentication"
-# section in the documentation for a list of which options are
-# available for which authentication methods.
-#
-# Database and user names containing spaces, commas, quotes and other
-# special characters must be quoted.  Quoting one of the keywords
-# "all", "sameuser", "samerole" or "replication" makes the name lose
-# its special character, and just match a database or username with
-# that name.
-#
-# This file is read on server startup and when the server receives a
-# SIGHUP signal.  If you edit the file on a running system, you have to
-# SIGHUP the server for the changes to take effect, run "pg_ctl reload",
-# or execute "SELECT pg_reload_conf()".
-#
-# Put your actual configuration here
-# ----------------------------------
-#
-# If you want to allow non-local connections, you need to add more
-# "host" records.  In that case you will also need to make PostgreSQL
-# listen on a non-local interface via the listen_addresses
-# configuration parameter, or via the -i or -h command line switches.
-
-# CAUTION: Configuring the system for local "trust" authentication
-# allows any local user to connect as any PostgreSQL user, including
-# the database superuser.  If you do not trust all your local users,
-# use another authentication method.
-
-
-# TYPE  DATABASE        USER            ADDRESS                 METHOD
-
-
 #
 # STEAMPIPE
 #
-
 # The root user is assumed by steampipe to manage the database configuration.
-# Access is not granted to users of steampipe. Ultimately the root user
-# password is stored in ~/.steampipe, so it's not really a secret, the aim
-# is just to protect users from misconfigurations.
+# Access is not granted to users of steampipe.
 #
 # The configuration is:
 # * Access is restricted to samehost
 # * Future - access via SSL only (remove host line)
-# * Future - access with a password only (change trust to scram-sha-256)
 #
-hostssl all root samehost trust
-host all root samehost trust
+hostssl	all root samehost trust
+host 	all root samehost trust
 
-# All user queries (steampipe query or steampipe service) are run as the
+# All user queries (steampipe query, steampipe service etc.) are run as the
 # steampipe user. The steampipe user is restricted in access to the steampipe
 # database, and further restricted by permissions to only read from steampipe
 # managed schemas. Write access is allowed to the public schema in the
@@ -112,8 +38,8 @@ host all root samehost trust
 # * Access from any other host does require a password
 # * Future - access via SSL only (remove host line)
 #
-hostssl steampipe steampipe samehost trust
-host steampipe steampipe samehost trust
-hostssl steampipe steampipe all scram-sha-256
-host steampipe steampipe all scram-sha-256
+hostssl %[1]s %[2]s samehost trust
+host 	%[1]s %[2]s samehost trust
+hostssl %[1]s %[2]s all scram-sha-256
+host 	%[1]s %[2]s all scram-sha-256
 `

db/db_local/create_client.go

@@ -24,18 +24,25 @@ func getLocalSteampipeConnectionString() (string, error) {
 	}
 
 	// Connect to the database using the first listen address, which is usually localhost
-	psqlInfo := fmt.Sprintf("host=%s port=%d user=%s dbname=%s sslmode=%s", info.Listen[0], info.Port, constants.DatabaseUser, constants.DatabaseName, SslMode())
+	psqlInfo := fmt.Sprintf("host=%s port=%d user=%s dbname=%s sslmode=%s", info.Listen[0], info.Port, constants.DatabaseUser, info.Database, SslMode())
 
 	return psqlInfo, nil
 }
 
+// createRootDbClient connects as a superuser to the
+// installed database, if available, otherwise to the default
+// "postgres" database
 func createRootDbClient() (*sql.DB, error) {
 	utils.LogTime("db.createSteampipeRootDbClient start")
 	defer utils.LogTime("db™.createSteampipeRootDbClient end")
 
-	return createLocalDbClient(constants.DatabaseName, constants.DatabaseSuperUser)
+	return createLocalDbClient("", constants.DatabaseSuperUser)
 }
 
+// createLocalDbClient connects and returns a connection to the given database using
+// the provided username
+// if the database is not provided, then it fallsback to the default database in the service
+// that was created during installation.
 func createLocalDbClient(dbname string, username string) (*sql.DB, error) {
 	utils.LogTime("db.createDbClient start")
 	defer utils.LogTime("db.createDbClient end")
@@ -50,6 +57,14 @@ func createLocalDbClient(dbname string, username string) (*sql.DB, error) {
 		return nil, fmt.Errorf("steampipe service is not running")
 	}
 
+	if len(dbname) == 0 {
+		dbname = info.Database
+	}
+	// if we still don't have it, fallback to default "postgres"
+	if len(dbname) == 0 {
+		dbname = "postgres"
+	}
+
 	// Connect to the database using the first listen address, which is usually localhost
 	psqlInfo := fmt.Sprintf("host=%s port=%d user=%s dbname=%s sslmode=%s", info.Listen[0], info.Port, username, dbname, SslMode())
 

db/db_local/functions.go

@@ -30,7 +30,7 @@ func refreshFunctions() error {
 
 	queries := []string{
 		fmt.Sprintf(`create schema if not exists %s;`, constants.FunctionSchema),
-		fmt.Sprintf(`grant usage on schema %s to steampipe_users;`, constants.FunctionSchema),
+		fmt.Sprintf(`grant usage on schema %s to %s;`, constants.FunctionSchema, constants.DatabaseUsersRole),
 	}
 	queries = append(queries, getFunctionAddStrings(constants.Functions)...)
 	if _, err := executeSqlAsRoot(queries...); err != nil {