Properly format ipv6 address for rsync

postgres-appliance/Dockerfile

@@ -18,7 +18,7 @@ FROM $BASE_IMAGE as dependencies-builder
 
 ARG DEMO
 
-ENV WALG_VERSION=v3.0.5
+ENV WALG_VERSION=v3.0.8
 
 COPY build_scripts/dependencies.sh /builddeps/
 
@@ -53,14 +53,12 @@ ARG DEB_PG_SUPPORTED_VERSIONS="$PGOLDVERSIONS $PGVERSION"
 
 # Install PostgreSQL, extensions and contribs
 ENV POSTGIS_VERSION=3.6 \
-    BG_MON_COMMIT=7f5887218790b263fe3f42f85f4ddc9c8400b154 \
+    BG_MON_COMMIT=a73c6bcd10dfdf9feaf5eabab7eb6b12d167680d \
     PG_AUTH_MON_COMMIT=fe099eef7662cbc85b0b79191f47f52f1e96b779 \
-    PG_MON_COMMIT=ead1de70794ed62ca1e34d4022f6165ff36e9a91 \
-    SET_USER=REL4_1_0 \
+    PG_MON_COMMIT=88ac7b58348aa061c814982defc170644f368f39 \
     PLPROFILER=REL4_2_5 \
-    PG_PROFILE=4.10 \
-    PAM_OAUTH2=v1.0.1 \
-    PG_PERMISSIONS_COMMIT=f4b7c18676fa64236a1c8e28d34a35764e4a70e2
+    PG_PROFILE=4.11 \
+    PAM_OAUTH2=v1.0.1
 
 WORKDIR /builddeps
 RUN bash base.sh

postgres-appliance/build_scripts/base.sh

@@ -53,9 +53,7 @@ fi
 
 curl -sL "https://github.com/zalando-pg/bg_mon/archive/$BG_MON_COMMIT.tar.gz" | tar xz
 curl -sL "https://github.com/zalando-pg/pg_auth_mon/archive/$PG_AUTH_MON_COMMIT.tar.gz" | tar xz
-curl -sL "https://github.com/cybertec-postgresql/pg_permissions/archive/$PG_PERMISSIONS_COMMIT.tar.gz" | tar xz
 curl -sL "https://github.com/zubkov-andrei/pg_profile/archive/$PG_PROFILE.tar.gz" | tar xz
-git clone -b "$SET_USER" https://github.com/pgaudit/set_user.git
 
 apt-get install -y \
     postgresql-common \
@@ -124,6 +122,8 @@ for version in $DEB_PG_SUPPORTED_VERSIONS; do
         "postgresql-server-dev-${version}" \
         "postgresql-${version}-pgq3" \
         "postgresql-${version}-pg-stat-kcache" \
+        "postgresql-${version}-pg-permissions" \
+        "postgresql-${version}-set-user" \
         "${EXTRAS[@]}"
 
     # Clean up timescaledb versions - keep at least 5 minor versions, but ensure compatibility with the lowest/oldest PG version (where possible)
@@ -183,11 +183,10 @@ for version in $DEB_PG_SUPPORTED_VERSIONS; do
 
     for n in bg_mon-${BG_MON_COMMIT} \
             pg_auth_mon-${PG_AUTH_MON_COMMIT} \
-            set_user \
-            pg_permissions-${PG_PERMISSIONS_COMMIT} \
             pg_profile-${PG_PROFILE} \
             "${EXTRA_EXTENSIONS[@]}"; do
-        make -C "$n" USE_PGXS=1 clean install-strip
+        PATH="/usr/lib/postgresql/$version/bin:$PATH" make -C "$n" USE_PGXS=1 clean
+        PATH="/usr/lib/postgresql/$version/bin:$PATH" make -C "$n" USE_PGXS=1 install-strip
     done
 done
 

postgres-appliance/build_scripts/dependencies.sh

@@ -29,9 +29,9 @@ apt-get install -y curl ca-certificates
 mkdir /builddeps/wal-g
 
 if [ "$ARCH" = "amd64" ]; then
-    PKG_NAME='wal-g-pg-ubuntu-20.04-amd64'
+    PKG_NAME='wal-g-pg-22.04-amd64'
 else
-    PKG_NAME='wal-g-pg-ubuntu-20.04-aarch64'
+    PKG_NAME='wal-g-pg-22.04-aarch64'
 fi
 
 curl -sL "https://github.com/wal-g/wal-g/releases/download/$WALG_VERSION/$PKG_NAME.tar.gz" \

postgres-appliance/major_upgrade/inplace_upgrade.py

@@ -711,6 +711,7 @@ def rsync_replica(config, desired_version, primary_ip, pid):
 
     env = os.environ.copy()
     env['RSYNC_PASSWORD'] = postgresql.config.replication['password']
+    primary_ip = f'[{primary_ip}]' if ':' in primary_ip else primary_ip
     if subprocess.call(['rsync', '--archive', '--delete', '--hard-links', '--size-only', '--omit-dir-times',
                         '--no-inc-recursive', '--include=/data/***', '--include=/data_old/***',
                         '--exclude=/data/pg_xlog/*', '--exclude=/data_old/pg_xlog/*',

postgres-appliance/scripts/basebackup.sh

@@ -19,6 +19,10 @@ done
 
 [[ -z $DATA_DIR || -z "$CONNSTR" || ! $RETRIES =~ ^[1-9]$ ]] && exit 1
 
+if [[ ! $CONNSTR =~ dbname= ]]; then
+    CONNSTR="${CONNSTR} dbname=postgres"
+fi
+
 if which pg_receivewal &> /dev/null; then
     PG_RECEIVEWAL=pg_receivewal
     PG_BASEBACKUP_OPTS=(-X none)
@@ -95,7 +99,7 @@ else
     receivewal_pid=$(cat "$WAL_FAST/receivewal.pid")
 fi
 
-PGVER=$(psql -d "$CONNSTR" -tAc "SELECT pg_catalog.current_setting('server_version_num')::int/10000" || echo 0)
+PGVER=$(psql "$CONNSTR" -tAc "SELECT pg_catalog.current_setting('server_version_num')::int/10000" || echo 0)
 if [[ $PGVER -ge 15 ]]; then
     PG_BASEBACKUP_OPTS+=("--compress=server-lz4")
 fi

postgres-appliance/scripts/configure_spilo.py

@@ -396,7 +396,7 @@ def deep_update(a, b):
 
 
 def get_provider():
-    provider = os.environ.get('SPILO_PROVIDER', PROVIDER_LOCAL)
+    provider = os.environ.get('SPILO_PROVIDER')
     if provider:
         if provider in {PROVIDER_AWS, PROVIDER_GOOGLE, PROVIDER_OPENSTACK, PROVIDER_LOCAL}:
             return provider
@@ -411,18 +411,23 @@ def get_provider():
         logging.info("Figuring out my environment (Google? AWS? Openstack? Local?)")
         response = requests.put(
             url='http://169.254.169.254/latest/api/token',
-            headers={'X-aws-ec2-metadata-token-ttl-seconds': '60'}
+            headers={'X-aws-ec2-metadata-token-ttl-seconds': '60'},
+            timeout=2
         )
+        if not response.ok:
+            logging.info("Failed to get IMDS token (status %s), assuming local Docker setup", response.status_code)
+            return PROVIDER_LOCAL
         token = response.text
         r = requests.get(
             url='http://169.254.169.254',
-            headers={'X-aws-ec2-metadata-token': token}
+            headers={'X-aws-ec2-metadata-token': token},
+            timeout=2
         )
         if r.headers.get('Metadata-Flavor', '') == 'Google':
             return PROVIDER_GOOGLE
         else:
             # accessible on Openstack, will fail on AWS
-            r = requests.get('http://169.254.169.254/openstack/latest/meta_data.json')
+            r = requests.get('http://169.254.169.254/openstack/latest/meta_data.json', timeout=2)
             if r.ok:
                 # make sure the response is parsable - https://github.com/Azure/aad-pod-identity/issues/943 and
                 # https://github.com/zalando/spilo/issues/542
@@ -432,7 +437,8 @@ def get_provider():
             # is accessible from both AWS and Openstack, Possiblity of misidentification if previous try fails
             r = requests.get(
                 url='http://169.254.169.254/latest/meta-data/ami-id',
-                headers={'X-aws-ec2-metadata-token': token}
+                headers={'X-aws-ec2-metadata-token': token},
+                timeout=2
             )
             return PROVIDER_AWS if r.ok else PROVIDER_UNSUPPORTED
     except (requests.exceptions.ConnectTimeout, requests.exceptions.ConnectionError, requests.exceptions.ReadTimeout):