neonvm: add file permissioning system to synchronised files

[conradludgate]

Postgres requires that the ssl_key_file file be

1. owned by postgres or by root
   2a. if owned by postgres, have mode 600.
   2b. if owned by root, have mode 640.

Otherwise we get a nice error

[253] FATAL:  private key file "/var/tls/tls.key" has group or world access

I don't like the solution I hacked together here. I need to see if it even works properly, but it seems to in my initial testing. I'm actually surprised because postgres also seems to check if the file is "regular" (not a symbolic link).

I am wondering if perhaps it would just be better to copy the file somewhere else in compute_ctl, but I guess that papers over the file permission issues - although I'm not convinced they exactly matter in our case? What other users exist in our computes?

[github-actions]

No changes to the coverage.

HTML Report

Click to open