Repository navigation
feat(digitalocean): connect the managed database DigitalOcean creates with the Droplet - #1378
Merged
Merged
Conversation
️✅ There are no secrets present in this pull request anymore.If these secrets were true positive and are still valid, we highly recommend you to revoke them. 🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request. |
… with the Droplet
When a buyer ticks "Add a Database" on the 1-Click, DigitalOcean writes
/root/.digitalocean_dbaas_credentials before the per-instance scripts run.
First boot now hands that file to a new helper, libredb-do-dbaas-seed, which
writes a seed file with one managed, admin-role, TLS-require connection per
cluster (PostgreSQL, MySQL, Valkey keystore) and keeps the password in the
root-only env file as a ${VAR} reference. The MOTD says whether the database
was added and, if not, why. Without the credentials file nothing changes.
Every first boot removes the previous seed file and status, so a Droplet made
from a customer's snapshot cannot report a database it no longer connects, and
the helper leaves an error status on any unforeseen failure. The image names
gid 1001 (the container's nodejs group) libredb-studio, so no later login on
the Droplet is handed that id. Listing and MOTD copy speak of the admin role,
not the admin account, and the README shows the verify-full upgrade with the
cluster CA.
…ot reseeds its cluster
cevheri
force-pushed
the
feat/do-managed-database-seed
branch
from
October 4, 2026 14:40
972c26f to
fac0d4c
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
cevheri
added a commit
that referenced
this pull request
Oct 5, 2026
…d three security fixes (#1531) Carries eight connection types for seven engines: etcd (#1228), IBM Db2 LUW (#1238), Neo4j with the Graph tab (#1239, #1289), Qdrant (#1270), Milvus (#1283), InfluxDB and InfluxDB 3 (#1309) and Oxia (#1310). Also CapRover and DigitalOcean discovery (#1502, #1378, #1528), launch sign-in for hosting platforms (#1516), and any number of local accounts with passkeys (#1122, #1195). Three security fixes: the OIDC state cookie is no longer accepted as a session (#1380), a non-admin role's DuckDB connection opens with file and network access off (#1519), and SQLite, DuckDB and LibreDB connections refuse Studio's own storage and credential files, with SQLite open to admins only in the editor, agent runs and MCP alike (#1523, #1529). Chart 0.1.78 is flagged containsSecurityUpdates, and its description calls Trino by its own name, the rename #1158 left for this bump.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When a customer adds a managed database while creating the LibreDB Studio 1-Click, DigitalOcean writes its credentials to /root/.digitalocean_dbaas_credentials.
First boot now turns that file into one managed seed connection: admin role only, TLS require, and the password kept in the root-only env file as a reference.
The MOTD says whether the database was added, and why not when it was not.
Nothing changes when there is no credentials file, or when the engine is not one Studio connects.
Not in this PR: the snapshot build, the paid real-cluster test and the Vendor Portal checkboxes, listed in deploy/digitalocean/README.md.