Skip to content

fix(conf): declare MinIO users in ha/trio template - #773

Merged
Vonng merged 1 commit into
pgsty:mainfrom
Mosney:fix/ha-trio-minio-users
Aug 14, 2026
Merged

fix(conf): declare MinIO users in ha/trio template#773
Vonng merged 1 commit into
pgsty:mainfrom
Mosney:fix/ha-trio-minio-users

Conversation

@Mosney

@Mosney Mosney commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

The ha/trio template enables MinIO as the pgBackRest repository but does not declare minio_users. When configure -g is used, the S3User.Backup value in pgbackrest_repo is randomized while the MinIO user continues to inherit the default secret from the role.

Declare the default MinIO users explicitly so generated credentials remain consistent.

Problem

The ha/trio template deploys MinIO and enables it as the pgBackRest
repository, but it does not explicitly declare minio_users.

When generating the configuration with:

./configure -c ha/trio -g -s

configure -g replaces S3User.Backup in:

pgbackrest_repo.minio.s3_key_secret

However, minio_users is absent from the generated configuration, so
the MinIO role continues to use its default S3User.Backup secret.

This results in different credentials being used by MinIO and
pgBackRest, causing:

HTTP 403 Forbidden
SignatureDoesNotMatch

during pgbackrest stanza-create.

Root cause

Password generation performs string replacement only on values present
in the selected configuration template. The ha/trio template contains
the pgBackRest S3 secret but not the corresponding MinIO user definition.

Fix

Explicitly declare the standard MinIO users in the ha/trio template,
following the same pattern used by other templates that enable MinIO
backups.

This allows configure -g to replace both the MinIO user secret and the
pgBackRest S3 secret with the same generated value.

The ha/trio template enables MinIO as the pgBackRest repository but does not declare minio_users. When configure -g is used, the S3User.Backup value in pgbackrest_repo is randomized while the MinIO user continues to inherit the default secret from the role.

Declare the default MinIO users explicitly so generated credentials remain consistent.
@Vonng
Vonng merged commit 0c8beab into pgsty:main Aug 14, 2026
2 checks passed
@Vonng

Vonng commented Aug 14, 2026

Copy link
Copy Markdown
Member

Thanks for catching this and providing a focused fix. This keeps the generated MinIO and pgBackRest credentials consistent in the ha/trio template. Merged—much appreciated!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants