feat(sudoers): let supabase-admin-agent invoke pgbackrest reconcile as root

ansible/files/adminapi.sudoers.conf

@@ -21,6 +21,10 @@ Cmnd_Alias PGBOUNCER = /bin/systemctl start pgbouncer.service, /bin/systemctl st
 # create/remove signal files owned by that user.
 %adminapi ALL= NOPASSWD: /usr/local/lib/supabase-admin-agent/pgdata-chown
 %adminapi ALL=(postgres) NOPASSWD: /usr/local/lib/supabase-admin-agent/pgdata-signal
+# Backfills /data/pgbackrest_spool (pgbackrest:postgres 0770) on instances whose
+# data volume predates postgres#2312's AMI directory-creation task -- called by
+# enable, setup-replica, and stanza-upgrade before archiving is activated/resumed.
+%adminapi ALL= NOPASSWD: /opt/supabase-admin-agent/supabase-admin-agent pgbackrest ensure-spool-dir
 # pgBackRest binary entries support two sudo chains used by supabase-admin-agent:
 # NewRunner()      — adminapi → /usr/bin/pgbackrest wrapper → sudo -u pgbackrest real_binary
 # NewRunnerAs()    — adminapi → sudo -u pgbackrest /usr/bin/pgbackrest → sudo -u pgbackrest real_binary

ansible/files/supabase_admin_agent_config/supabase-admin-agent.sudoers.conf

@@ -1,2 +1,4 @@
 %supabase-admin-agent ALL= NOPASSWD: /usr/bin/salt-call
 %supabase-admin-agent ALL= NOPASSWD: /usr/bin/gpg --homedir /etc/salt/gpgkeys --import, /usr/bin/gpg --homedir /etc/salt/gpgkeys --list-secret-keys *
+# pgbackrest reconcile writes /etc/pgbackrest/conf.d (pgbackrest:postgres 02770) and the agent is in neither group, so this subcommand needs root; the salt subcommand above stays unprivileged
+%supabase-admin-agent ALL= NOPASSWD: /opt/supabase-admin-agent/supabase-admin-agent pgbackrest reconcile

ansible/tasks/internal/supabase-admin-agent.yml

@@ -15,7 +15,10 @@
 - name: supabase-admin-agent - config dir
   file:
     path: /opt/supabase-admin-agent
-    owner: supabase-admin-agent
+    # /opt/supabase-admin-agent (dir, unpacked binary, symlink) is all root-owned so the pgbackrest-reconcile sudo grant below can't be used to swap the binary first; the agent group already has effectively unrestricted root via the salt-call entry, this just closes one more tampering path
+    owner: root
+    group: root
+    mode: "0755"
     state: directory
 
 - name: supabase-admin-agent - gpg dir
@@ -30,6 +33,7 @@
     src: files/supabase_admin_agent_config/supabase-admin-agent.sudoers.conf
     dest: /etc/sudoers.d/supabase-admin-agent
     mode: "0440"
+    validate: "visudo -csf %s"
 
 - name: supabase-admin-agent - pgbackrest helper scripts dir
   file:
@@ -74,7 +78,9 @@
     remote_src: yes
     src: /tmp/supabase-admin-agent.tar.gz
     dest: /opt/supabase-admin-agent/
-    owner: supabase-admin-agent
+    owner: root
+    group: root
+    mode: "0755"
     extra_opts:
       - --strip-components=1
 
@@ -83,7 +89,6 @@
     path: /opt/supabase-admin-agent/supabase-admin-agent
     src: "/opt/supabase-admin-agent/supabase-admin-agent-linux-{{ platform }}"
     state: link
-    owner: supabase-admin-agent
     mode: "0755"
     force: yes