d10efadaba
A plain CREATE ROLE ... PASSWORD stores PostgreSQL's native 16-byte SCRAM salt. DocumentDB has no check_password_hook, so that salt is served verbatim to Mongo clients, which reject it at SASL step2 with 'invalid salt length of 16'. Provision the user through documentdb_api.create_user / update_user instead: DocumentDB builds the SCRAM-SHA-256 verifier with documentdb.scramDefaultSaltLen (28 bytes) via its own scram_build_secret. create_user only accepts a read-only role or the clusterAdmin + readWriteAnyDatabase pair, so use the latter for R/W. - CREATE EXTENSION documentdb now runs before user provisioning so the API functions exist. - Spec built with jq (password JSON-escaped) and passed in a $DDB$ dollar-quoted SQL literal; idempotent via update_user when the role already exists. - Set password_encryption = 'scram-sha-256' explicitly in postgresql.conf.
infra-scripts
Public infrastructure deployment scripts designed to be executed directly via curl | bash.
Philosophy
These scripts automate the deployment of personal infrastructure components. They are:
- Self-contained: No external dependencies beyond standard Debian packages
- Idempotent-ish: Safe to re-run (where possible)
- Curl-friendly: Designed for one-liner deployment from a fresh server
- Multi-OS: Supports Debian and Alpine-based deployments
- Loopback by default: Services bind to
127.0.0.1; Tailscale handles the reverse proxy and TLS termination - Log hygiene: Every long-running service ships with a
logrotateconfig (no unbounded log files) - Console auto-login: Proxmox LXCs are configured for root auto-login on
tty1(fastpct enterand Web UI shell access) - Keep it simple: One script per service, plain bash, no frameworks — readability over cleverness
Available Scripts
| Script | Description | Usage |
|---|---|---|
proxy/install.sh |
Reverse proxy with Tailscale + Nginx Proxy Manager | curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/proxy/install.sh | bash |
netlab/install.sh |
Network lab with ContainerLab | curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/netlab/install.sh | bash |
gitea-runner/install.sh |
Gitea Act Runner on Alpine LXC (Proxmox) | bash -c "$(curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/gitea-runner/install.sh)" |
openbao/install.sh |
OpenBao secrets manager on Alpine LXC (Proxmox) | bash -c "$(curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/openbao/install.sh)" |
ferretdb/install.sh |
FerretDB (MongoDB-compatible) on Debian LXC (Proxmox) | bash -c "$(curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/ferretdb/install.sh)" |
Requirements
- Fresh Debian 12/13 installation (proxy, netlab) or Proxmox VE host (gitea-runner, openbao, ferretdb)
- User with sudo privileges (do not run as root) — except gitea-runner, openbao and ferretdb which run as root on Proxmox
- Internet access