AMI: Pin down uid/gid values when creating users/groups

.ansible-lint-ignore

@@ -0,0 +1,100 @@
+# This file contains ignores rule violations for ansible-lint
+ansible/files/envoy_config/cds.yaml yaml[empty-lines]
+ansible/files/envoy_config/envoy.yaml yaml[empty-lines]
+ansible/files/envoy_config/lds.supabase.yaml yaml[empty-lines]
+ansible/files/envoy_config/lds.yaml yaml[empty-lines]
+ansible/playbook.yml command-instead-of-module
+ansible/playbook.yml command-instead-of-shell
+ansible/playbook.yml fqcn[action-core]
+ansible/playbook.yml name[casing]
+ansible/playbook.yml name[missing]
+ansible/playbook.yml name[play]
+ansible/playbook.yml no-changed-when
+ansible/playbook.yml risky-file-permissions
+ansible/tasks/finalize-ami.yml fqcn[action-core]
+ansible/tasks/finalize-ami.yml name[casing]
+ansible/tasks/finalize-ami.yml risky-file-permissions
+ansible/tasks/fix-ipv6-ndisc.yml name[casing]
+ansible/tasks/internal/admin-api.yml fqcn[action-core]
+ansible/tasks/internal/admin-api.yml fqcn[action]
+ansible/tasks/internal/admin-api.yml name[casing]
+ansible/tasks/internal/admin-api.yml no-changed-when
+ansible/tasks/internal/admin-api.yml risky-file-permissions
+ansible/tasks/internal/admin-mgr.yml fqcn[action-core]
+ansible/tasks/internal/admin-mgr.yml name[casing]
+ansible/tasks/internal/admin-mgr.yml risky-file-permissions
+ansible/tasks/internal/collect-pg-binaries.yml fqcn[action-core]
+ansible/tasks/internal/collect-pg-binaries.yml fqcn[action]
+ansible/tasks/internal/collect-pg-binaries.yml risky-file-permissions
+ansible/tasks/internal/install-aws-cli.yml name[casing]
+ansible/tasks/internal/install-aws-cli.yml no-changed-when
+ansible/tasks/internal/install-aws-cli.yml risky-file-permissions
+ansible/tasks/internal/install-salt.yml fqcn[action-core]
+ansible/tasks/internal/install-salt.yml jinja[spacing]
+ansible/tasks/internal/install-salt.yml name[casing]
+ansible/tasks/internal/optimizations.yml fqcn[action-core]
+ansible/tasks/internal/optimizations.yml name[casing]
+ansible/tasks/internal/pg_egress_collect.yml fqcn[action-core]
+ansible/tasks/internal/pg_egress_collect.yml name[casing]
+ansible/tasks/internal/pg_egress_collect.yml risky-file-permissions
+ansible/tasks/internal/pg_egress_collect.yml yaml[empty-lines]
+ansible/tasks/internal/postgres-exporter.yml fqcn[action-core]
+ansible/tasks/internal/postgres-exporter.yml fqcn[action]
+ansible/tasks/internal/postgres-exporter.yml name[casing]
+ansible/tasks/internal/postgres-exporter.yml risky-file-permissions
+ansible/tasks/internal/postgresql-prestart.yml fqcn[action-core]
+ansible/tasks/internal/postgresql-prestart.yml name[casing]
+ansible/tasks/internal/setup-ansible-pull.yml fqcn[action-core]
+ansible/tasks/internal/setup-ansible-pull.yml name[casing]
+ansible/tasks/internal/setup-ansible-pull.yml no-changed-when
+ansible/tasks/internal/setup-ansible-pull.yml risky-file-permissions
+ansible/tasks/internal/setup-nftables.yml fqcn[action-core]
+ansible/tasks/internal/setup-nftables.yml name[casing]
+ansible/tasks/internal/setup-nftables.yml no-changed-when
+ansible/tasks/internal/setup-nftables.yml risky-file-permissions
+ansible/tasks/internal/supabase-admin-agent.yml fqcn[action-core]
+ansible/tasks/internal/supabase-admin-agent.yml name[casing]
+ansible/tasks/internal/supabase-admin-agent.yml risky-file-permissions
+ansible/tasks/setup-fail2ban.yml name[casing]
+ansible/tasks/setup-fail2ban.yml risky-file-permissions
+ansible/tasks/setup-gotrue.yml name[casing]
+ansible/tasks/setup-gotrue.yml risky-file-permissions
+ansible/tasks/setup-kong.yml fqcn[action-core]
+ansible/tasks/setup-kong.yml no-changed-when
+ansible/tasks/setup-kong.yml risky-file-permissions
+ansible/tasks/setup-kvm-timesync.yml name[casing]
+ansible/tasks/setup-kvm-timesync.yml risky-file-permissions
+ansible/tasks/setup-migrations.yml name[casing]
+ansible/tasks/setup-migrations.yml no-changed-when
+ansible/tasks/setup-migrations.yml risky-file-permissions
+ansible/tasks/setup-pgbouncer.yml name[casing]
+ansible/tasks/setup-pgbouncer.yml no-changed-when
+ansible/tasks/setup-pgbouncer.yml risky-file-permissions
+ansible/tasks/setup-postgres.yml fqcn[action-core]
+ansible/tasks/setup-postgres.yml name[casing]
+ansible/tasks/setup-postgres.yml no-changed-when
+ansible/tasks/setup-postgres.yml risky-file-permissions
+ansible/tasks/setup-postgres.yml yaml[octal-values]
+ansible/tasks/setup-postgrest.yml jinja[spacing]
+ansible/tasks/setup-postgrest.yml name[casing]
+ansible/tasks/setup-postgrest.yml no-changed-when
+ansible/tasks/setup-postgrest.yml risky-file-permissions
+ansible/tasks/setup-supabase-internal.yml fqcn[action-core]
+ansible/tasks/setup-supabase-internal.yml name[casing]
+ansible/tasks/setup-supabase-internal.yml no-changed-when
+ansible/tasks/setup-supabase-internal.yml risky-file-permissions
+ansible/tasks/setup-supautils.yml name[casing]
+ansible/tasks/setup-supautils.yml risky-file-permissions
+ansible/tasks/setup-system.yml name[casing]
+ansible/tasks/setup-system.yml risky-file-permissions
+ansible/tasks/setup-tmux.yml name[casing]
+ansible/tasks/setup-wal-g.yml name[casing]
+ansible/tasks/setup-wal-g.yml no-changed-when
+ansible/tasks/stage2-setup-postgres.yml fqcn[action-core]
+ansible/tasks/stage2-setup-postgres.yml name[casing]
+ansible/tasks/stage2-setup-postgres.yml no-changed-when
+ansible/tasks/stage2-setup-postgres.yml risky-file-permissions
+ansible/tasks/stage2-setup-postgres.yml risky-shell-pipe
+ansible/tasks/stage2-setup-postgres.yml yaml[commas]
+ansible/tasks/test-image.yml no-changed-when
+ansible/tasks/test-image.yml risky-file-permissions

.gitignore

@@ -2,6 +2,7 @@
 !.env
 !.gitignore
 !.gitkeep
+!/.ansible-lint-ignore
 !/.claude/
 !/.coderabbit.yaml
 !/.envrc.recommended

ansible/ansible-lint.yaml

@@ -0,0 +1,3 @@
+use_default_rules: true
+rulesdir:
+  - lint-rules

ansible/lint-rules/identity_ids.py

@@ -0,0 +1,31 @@
+from ansiblelint.file_utils import Lintable
+from ansiblelint.rules import AnsibleLintRule
+from ansiblelint.utils import Task
+
+
+class ExplicitIdentityIDRule(AnsibleLintRule):
+    id = "explicit-identity-id"
+    shortdesc = "Users and groups must specify numeric IDs"
+    description = "ansible.builtin.user must specify uid and ansible.builtin.group must specify gid."
+    severity = "HIGH"
+    tags = ["idempotency"]
+    version_changed = "1.0.0"
+
+    def matchtask(
+        self,
+        task: Task,
+        file: Lintable | None = None,
+    ) -> bool | str:
+        action = task["action"]
+        module = action["__ansible_module__"].rsplit(".", 1)[-1]
+
+        if action.get("state", "present") == "absent":
+            return False
+
+        if module == "user" and "uid" not in action:
+            return "ansible.builtin.user must specify uid"
+
+        if module == "group" and "gid" not in action:
+            return "ansible.builtin.group must specify gid"
+
+        return False

ansible/playbook.yml

@@ -183,10 +183,10 @@
         systemctl stop fail2ban.service
 
     - name: Run supascan baseline validation
-      when: stage2 and not qemu and ansible_architecture != "x86_64"
+      when: stage2 and not qemu
       become: yes
       shell: |
-        /bin/bash /tmp/ansible-playbook/ansible/files/supascan_ami.sh /tmp/ansible-playbook/audit-specs/baselines/ami-build
+        /bin/bash /tmp/ansible-playbook/ansible/files/supascan_ami.sh /tmp/ansible-playbook/audit-specs/baselines/ami-build-{{ platform }}
 
     - name: Remove supascan after validation
       when: stage2

ansible/tasks/internal/admin-api.yml

@@ -1,8 +1,15 @@
+- name: adminapi - system group
+  ansible.builtin.group:
+    name: adminapi
+    gid: 1011
+    state: present
+
 - name: adminapi - system user
-  user:
+  ansible.builtin.user:
     name: adminapi
-    groups: root,admin,envoy,gotrue,kong,pgbouncer,postgres,postgrest,systemd-journal,vector,wal-g
-    append: yes
+    uid: 1006
+    group: adminapi
+    groups: admin,envoy,gotrue,kong,pgbouncer,postgres,postgrest,root,systemd-journal,vector,wal-g
 
 - name: Move shell scripts to /root dir
   copy:

ansible/tasks/internal/supabase-admin-agent.yml

@@ -1,11 +1,13 @@
 - name: supabase-admin-agent - system group
-  group:
+  ansible.builtin.group:
     name: supabase-admin-agent
+    gid: 987
     system: yes
 
 - name: supabase-admin-agent - system user
-  user:
+  ansible.builtin.user:
     name: supabase-admin-agent
+    uid: 990
     group: supabase-admin-agent
     groups: admin,salt
     append: yes

ansible/tasks/setup-envoy.yml

@@ -1,7 +1,15 @@
-- name: Envoy - system user
+- name: Envoy - group
+  ansible.builtin.group:
+    name: envoy
+    gid: 1008
+    state: present
+
+- name: Envoy - user
   ansible.builtin.user:
-    name: 'envoy'
-    state: 'present'
+    name: envoy
+    uid: 1003
+    group: envoy
+    state: present
 
 - name: Envoy - download binary
   ansible.builtin.get_url:

ansible/tasks/setup-gotrue.yml

@@ -4,10 +4,18 @@
     rule: 'allow'
 
 # use this user for the Gotrue build and for running the service
+- name: Gotrue - group
+  ansible.builtin.group:
+    name: gotrue
+    gid: 1006
+    state: present
+
 - name: Gotrue - system user
   ansible.builtin.user:
-    name: 'gotrue'
-    state: 'present'
+    name: gotrue
+    uid: 1001
+    group: gotrue
+    state: present
 
 - name: gotrue - download commit archive
   ansible.builtin.get_url:

ansible/tasks/setup-kong.yml

@@ -1,7 +1,15 @@
-- name: Kong - system user
+- name: Kong - group
+  ansible.builtin.group:
+    name: kong
+    gid: 1009
+    state: present
+
+- name: Kong - user
   ansible.builtin.user:
-    name: 'kong'
-    state: 'present'
+    name: kong
+    uid: 1004
+    group: kong
+    state: present
 
 # Kong installation steps from http://archive.vn/3HRQx
 - name: Kong - system dependencies

ansible/tasks/setup-pgbackrest.yml

@@ -2,16 +2,18 @@
   when: not stage2
   ansible.builtin.group:
     name: pgbackrest
+    gid: 1005
     state: present
 
 - name: Create pgBackRest user
   when: not stage2
   ansible.builtin.user:
+    name: pgbackrest
+    uid: 995
     comment: pgBackRest user
     group: pgbackrest
     groups: pgbackrest, postgres
     home: /var/lib/pgbackrest
-    name: pgbackrest
     shell: /sbin/nologin
     system: true
 

ansible/tasks/setup-pgbouncer.yml

@@ -1,10 +1,18 @@
 # PgBouncer
+- name: Create pgbouncer group
+  ansible.builtin.group:
+    name: pgbouncer
+    gid: 1003
+    state: 'present'
+
 - name: Create pgbouncer user
   ansible.builtin.user:
+    name: 'pgbouncer'
+    uid: 1000
     comment: 'PgBouncer user'
+    group: pgbouncer
     groups: 'postgres,ssl-cert'
-    name: 'pgbouncer'
-    shell: '/usr/sbin/nolign'
+    shell: '/usr/sbin/nologin'
     state: 'present'
 
 - name: Install PgBouncer from nix binary cache

ansible/tasks/setup-postgres.yml

@@ -3,24 +3,27 @@
   block:
     # the old method of installing from debian creates this group, but we must create it explicitly
     # for the nix built version
-    - name: create ssl-cert and postgres groups
+    - name: create ssl-cert group # noqa: explicit-identity-id
       ansible.builtin.group:
-        name: "{{ group_item }}"
-        state: 'present'
-      loop:
-        - 'ssl-cert'
-        - 'postgres'
-      loop_control:
-        loop_var: 'group_item'
+        name: ssl-cert
+        gid: 1001
+        state: present
+
+    - name: create postgres group
+      ansible.builtin.group:
+        name: postgres
+        gid: 1002
+        state: present
 
     - name: create postgres user
       ansible.builtin.user:
+        name: 'postgres'
+        uid: 999
         comment: 'PostgreSQL administrator'
         create_home: false
         group: 'postgres'
         groups: 'ssl-cert'
         home: '/var/lib/postgresql'
-        name: 'postgres'
         shell: '/bin/bash'
         state: 'present'
         system: true

ansible/tasks/setup-postgrest.yml

@@ -1,7 +1,15 @@
-- name: PostgREST - system user
+- name: PostgREST - group
+  ansible.builtin.group:
+    name: postgrest
+    gid: 1007
+    state: present
+
+- name: PostgREST - user
   ansible.builtin.user:
-    name: 'postgrest'
-    state: 'present'
+    name: postgrest
+    uid: 1002
+    group: postgrest
+    state: present
 
 - name: PostgREST - add Postgres PPA gpg key
   ansible.builtin.get_url:

ansible/tasks/setup-supabase-internal.yml

@@ -19,12 +19,19 @@
     deb: /tmp/vector.deb
   become: true
 
-- name: add Vector to postgres group
+- name: add vector system group
+  ansible.builtin.group:
+    name: vector
+    gid: 989
+    system: yes
+
+- name: add vector system user
   ansible.builtin.user:
-    append: true
-    groups: 'postgres'
-    name: 'vector'
-  become: true
+    name: vector
+    uid: 994
+    group: vector
+    groups: postgres
+    append: yes
 
 - name: create service files for Vector
   ansible.builtin.template: