Merge pull request #266270 from Ma27/postgresql-ownership-15

## Backward Incompatibilities {#sec-release-23.11-incompatibilities}

- `services.postgresql.ensurePermissions` has been deprecated in favor of `services.postgresql.ensureUsers.*.ensureDBOwnership` which simplifies the setup of database owned by a certain system user

  in local database contexts (which make use of peer authentication via UNIX sockets), migration guidelines were provided in the NixOS manual, please refer to them if you are affected by a PostgreSQL 15 changing the way `GRANT ALL PRIVILEGES` is working. `services.postgresql.ensurePermissions` will be removed in 24.05. All NixOS modules were migrated using one of the strategy, e.g. `ensureDBOwnership` or `postStart`. More about this situation can be learnt in https://github.com/NixOS/nixpkgs/pull/266270.

- `network-online.target` has been fixed to no longer time out for systems with `networking.useDHCP = true` and `networking.useNetworkd = true`.

  Workarounds for this can be removed.

            ensurePermissions = mkOption {

              type = types.attrsOf types.str;

              default = {};

              visible = false; # This option has been deprecated.

              description = lib.mdDoc ''

                This option is DEPRECATED and should not be used in nixpkgs anymore,

                use `ensureDBOwnership` instead. It can also break with newer

                versions of PostgreSQL (≥ 15).

                Permissions to ensure for the user, specified as an attribute set.

                The attribute names specify the database and tables to grant the permissions for.

                The attribute values specify the permissions to grant. You may specify one or

              '';

            };

            ensureDBOwnership = mkOption {

              type = types.bool;

              default = false;

              description = mdDoc ''

                Grants the user ownership to a database with the same name.

                This database must be defined manually in

                [](#opt-services.postgresql.ensureDatabases).

              '';

            };

            ensureClauses = mkOption {

              description = lib.mdDoc ''

                An attrset of clauses to grant to the user. Under the hood this uses the

        });

        default = [];

        description = lib.mdDoc ''

          Ensures that the specified users exist and have at least the ensured permissions.

          Ensures that the specified users exist.

          The PostgreSQL users will be identified using peer authentication. This authenticates the Unix user with the

          same name only, and that without the need for a password.

          This option will never delete existing users or remove permissions, especially not when the value of this

          option is changed. This means that users created and permissions assigned once through this option or

          otherwise have to be removed manually.

          This option will never delete existing users or remove DB ownership of databases

          once granted with `ensureDBOwnership = true;`. This means that this must be

          cleaned up manually when changing after changing the config in here.

        '';

        example = literalExpression ''

          [

            {

              name = "nextcloud";

              ensurePermissions = {

                "DATABASE nextcloud" = "ALL PRIVILEGES";

              };

            }

            {

              name = "superuser";

              ensurePermissions = {

                "ALL TABLES IN SCHEMA public" = "ALL PRIVILEGES";

              };

              ensureDBOwnership = true;

            }

          ]

        '';

  config = mkIf cfg.enable {

    assertions = map ({ name, ensureDBOwnership, ... }: {

      assertion = ensureDBOwnership -> builtins.elem name cfg.ensureDatabases;

      message = ''

        For each database user defined with `services.postgresql.ensureUsers` and

        `ensureDBOwnership = true;`, a database with the same name must be defined

        in `services.postgresql.ensureDatabases`.

        Offender: ${name} has not been found among databases.

      '';

    }) cfg.ensureUsers;

    # `ensurePermissions` is now deprecated, let's avoid it.

    warnings = lib.optional (any ({ ensurePermissions, ... }: ensurePermissions != {}) cfg.ensureUsers) "

      `services.postgresql.*.ensurePermissions` is used in your expressions,

      this option is known to be broken with newer PostgreSQL versions,

      consider migrating to `services.postgresql.*.ensureDBOwnership` or

      consult the release notes or manual for more migration guidelines.

      This option will be removed in NixOS 24.05 unless it sees significant

      maintenance improvements.

    ";

    services.postgresql.settings =

      {

        hba_file = "${pkgs.writeText "pg_hba.conf" cfg.authentication}";

                      (database: permission: ''$PSQL -tAc 'GRANT ${permission} ON ${database} TO "${user.name}"' '')

                      user.ensurePermissions

                    );

                  dbOwnershipStmt = optionalString

                    user.ensureDBOwnership

                    ''$PSQL -tAc 'ALTER DATABASE "${user.name}" OWNER TO "${user.name}";' '';

                  filteredClauses = filterAttrs (name: value: value != null) user.ensureClauses;

                  $PSQL -tAc "SELECT 1 FROM pg_roles WHERE rolname='${user.name}'" | grep -q 1 || $PSQL -tAc 'CREATE USER "${user.name}"'

                  ${userPermissions}

                  ${userClauses}

                  ${dbOwnershipStmt}

                ''

              )

              cfg.ensureUsers

    assertions = [

      {

        assertion = cfg.database.createLocally -> cfg.database.user == "zammad";

        assertion = cfg.database.createLocally -> cfg.database.user == "zammad" && cfg.database.name == "zammad";

        message = "services.zammad.database.user must be set to \"zammad\" if services.zammad.database.createLocally is set to true";

      }

      {

      ensureUsers = [

        {

          name = cfg.database.user;

          ensurePermissions = { "DATABASE ${cfg.database.name}" = "ALL PRIVILEGES"; };

          ensureDBOwnership = true;

        }

      ];

    };

      ensureDatabases = [ "odoo" ];

      ensureUsers = [{

        name = "odoo";

        ensurePermissions = { "DATABASE odoo" = "ALL PRIVILEGES"; };

        ensureDBOwnership = true;

      }];

    };

  });

      ensureUsers = [{

        name = "listmonk";

        ensurePermissions = { "DATABASE listmonk" = "ALL PRIVILEGES"; };

        ensureDBOwnership = true;

      }];

      ensureDatabases = [ "listmonk" ];