PostgreSQL without superuser privileges _at all?_

[ELLIOTTCABLE]

I'm trying to use my VPS provider's managed databases, but even given their 'admin user' creds, I get:

$ psql windmilldb -f init-db-as-superuser.sql
CREATE ROLE
GRANT
GRANT
ALTER DEFAULT PRIVILEGES
ALTER DEFAULT PRIVILEGES
psql:init-db-as-superuser.sql:20: ERROR:  must be superuser to create bypassrls users
psql:init-db-as-superuser.sql:24: ERROR:  role "windmill_admin" does not exist
psql:init-db-as-superuser.sql:28: ERROR:  role "windmill_admin" does not exist
psql:init-db-as-superuser.sql:32: ERROR:  role "windmill_admin" does not exist
psql:init-db-as-superuser.sql:36: ERROR:  role "windmill_admin" does not exist

It looks like they don't support superusers at all:

How do I create an admin (superuser) or root-level account?

You cannot create superuser accounts. To create a standard user account, use the Vultr customer portal.

Is the windmill_admin user absolutely necessary, WITH BYPASSRLS? Is there any way I can circumvent this? /=

[rubenfiszel]

Do you need RLS ? (Do you have non-admins users that shouldn't be able to see/edit everything) ? If not, you could remove BYPASSRLS from that statement and then we would need to disable row level services on all the relevant tables.

[ELLIOTTCABLE]

Hm. I suppose I could get by without that — just to rephrase, it's a setup in which every single GUI "Windmill user" would effectively be a Windmill admin?

It's not ideal, but it's probably better than my other alternatives, heh:

1. using a half-assed non-managed database setup and either potentially losing all my data,
2. (or losing a ton of my limited family-infrastructure-as-a-hobby-time to stuff like upgrades and migrations and backups, lmao),
3. or switching VPS providers entirely, now that I've learned so much of this one. 😓

Perhaps an insecure/pseudo-trusted option would be worthwhile someday? Hiding other users' workflows and such in the GUI with a simple flag, even though they're not securely separated?

Apropos nothing: Too bad y'all ain't using OCaml, I'd work with you in a heartbeat. Awesome product and vision, cool-looking team.

[ELLIOTTCABLE]

Okay, trying that out — removed BYPASSRLS. As mentioned in the discord, I booted everything up for the first time, so it could run the migrations; then I ran this:

ALTER TABLE folder DISABLE ROW LEVEL SECURITY;
ALTER TABLE account DISABLE ROW LEVEL SECURITY;
ALTER TABLE audit DISABLE ROW LEVEL SECURITY;
ALTER TABLE queue DISABLE ROW LEVEL SECURITY;
ALTER TABLE completed_job DISABLE ROW LEVEL SECURITY;

ALTER TABlE resource DISABLE ROW LEVEL SECURITY;
ALTER TABlE script DISABLE ROW LEVEL SECURITY;
ALTER TABlE variable DISABLE ROW LEVEL SECURITY;
ALTER TABlE schedule DISABLE ROW LEVEL SECURITY;
ALTER TABlE flow DISABLE ROW LEVEL SECURITY;

ALTER TABLE usr_to_group DISABLE ROW LEVEL SECURITY;
ALTER TABLE app DISABLE ROW LEVEL SECURITY;
ALTER TABLE capture DISABLE ROW LEVEL SECURITY;