fix: enable services, fix config parsing, make migrations idempotent

Cargo.toml

@@ -12,7 +12,7 @@ members = [
 ]
 
 [workspace.package]
-version = "1.1.10"
+version = "1.1.8"
 edition = "2021"
 authors = ["Echo <echo@moon-dragon.us>"]
 license = "MIT"

debian/changelog

@@ -1,15 +1,3 @@
-linux-patch-manager (1.1.10-1) unstable; urgency=low
-
-  * Release v1.1.10
-
- -- git-echo <git-echo@moon-dragon.us>  Tue, 09 Jun 2026 14:11:31 -0500
-
-linux-patch-manager (1.1.9-1) unstable; urgency=low
-
-  * Release v1.1.9
-
- -- git-echo <git-echo@moon-dragon.us>  Tue, 09 Jun 2026 13:05:59 -0500
-
 linux-patch-manager (1.1.8-1) unstable; urgency=low
 
   * Release v1.1.8

debian/control

@@ -1,5 +1,5 @@
 Package: linux-patch-manager
-Version: 1.1.10-1
+Version: 1.1.8-1
 Architecture: amd64
 Maintainer: Moon Dragon <echo@moon-dragon.us>
 Installed-Size: 45000

debian/postinst

@@ -34,16 +34,10 @@ psql_run() {
 }
 
 psql_run_db() {
-    # Run SQL against the patch_manager database as postgres superuser
+    # Run SQL against the patch_manager database
     sudo -u postgres psql -v ON_ERROR_STOP=1 -d "${DB_NAME}" "$@" 2>/dev/null
 }
 
-psql_run_as_pm() {
-    # Run SQL against the patch_manager database as patch_manager user
-    # Requires PGPASSWORD to be set in the calling environment
-    PGPASSWORD="${PGPASSWORD}" psql -v ON_ERROR_STOP=1 -U "${DB_USER}" -h localhost -d "${DB_NAME}" "$@" 2>/dev/null
-}
-
 # ---------------------------------------------------------------------------
 # 1. Create service user (idempotent)
 # ---------------------------------------------------------------------------
@@ -146,47 +140,23 @@ setup_database() {
         info "Database '${DB_NAME}' already exists, skipping creation."
     fi
 
-    # Grant full permissions so patch_manager owns and manages all objects
+    # Grant permissions (idempotent)
-    psql_run_db -c "GRANT ALL PRIVILEGES ON SCHEMA public TO ${DB_USER};" 2>/dev/null || true
+    psql_run_db -c "GRANT USAGE ON SCHEMA public TO ${DB_USER};" 2>/dev/null || true
+    psql_run_db -c "GRANT CREATE ON SCHEMA public TO ${DB_USER};" 2>/dev/null || true
     psql_run_db -c "GRANT ALL PRIVILEGES ON DATABASE ${DB_NAME} TO ${DB_USER};" 2>/dev/null || true
-    # If any future migration runs as postgres, ensure objects are still accessible by patch_manager
-    psql_run_db -c "ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO ${DB_USER};" 2>/dev/null || true
-    psql_run_db -c "ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO ${DB_USER};" 2>/dev/null || true
-    psql_run_db -c "ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO ${DB_USER};" 2>/dev/null || true
 }
 
 # ---------------------------------------------------------------------------
 # 5. Apply database migrations (idempotent)
-# Migrations run as patch_manager so all created objects are owned by
-# patch_manager — this avoids the ownership conflicts that occur when
-# postgres-owned objects need ALTER TABLE by a non-superuser.
 # ---------------------------------------------------------------------------
 apply_migrations() {
     info "Applying database migrations..."
 
-    # Get the DB password for patch_manager authentication
+    # Ensure pgcrypto extension is available
-    local db_password=""
-    if [[ -f /tmp/.pm-db-password-new ]]; then
-        db_password=$(cat /tmp/.pm-db-password-new)
-    else
-        # Fallback: extract from config
-        local config_file="${CONFIG_DIR}/config.toml"
-        if [[ -f "${config_file}" ]]; then
-            db_password=$(sed -n 's|^url = "postgres://[^:]*:\(.*\)@localhost.*"|\1|p' "${config_file}" | head -1)
-        fi
-        if [[ -z "${db_password}" || "${db_password}" == "CHANGEME" ]]; then
-            error "Cannot determine DB password for migrations."
-            return 1
-        fi
-    fi
-
-    export PGPASSWORD="${db_password}"
-
-    # Ensure pgcrypto extension is available (requires superuser)
     psql_run_db -c "CREATE EXTENSION IF NOT EXISTS pgcrypto;" 2>/dev/null || true
 
-    # Create migration tracking table if not exists (run as patch_manager)
+    # Create migration tracking table if not exists
-    psql_run_as_pm <<'MIGSQL'
+    psql_run_db <<'MIGSQL'
 CREATE TABLE IF NOT EXISTS _migrations (
     id          SERIAL PRIMARY KEY,
     filename    TEXT    NOT NULL UNIQUE,
@@ -197,11 +167,11 @@ MIGSQL
     # Handle upgrade from pre-migration-tracking versions:
     # If tables exist but _migrations is empty, mark all existing migrations as applied.
     local migration_count
-    migration_count=$(psql_run_as_pm -t -A -c "SELECT COUNT(*) FROM _migrations;" 2>/dev/null || echo "0")
+    migration_count=$(psql_run_db -t -A -c "SELECT COUNT(*) FROM _migrations;" 2>/dev/null || echo "0")
     migration_count="${migration_count// /}"
 
     local tables_exist
-    tables_exist=$(psql_run_as_pm -t -A -c "SELECT COUNT(*) FROM information_schema.tables WHERE table_schema='public' AND table_name='users';" 2>/dev/null || echo "0")
+    tables_exist=$(psql_run_db -t -A -c "SELECT COUNT(*) FROM information_schema.tables WHERE table_schema='public' AND table_name='users';" 2>/dev/null || echo "0")
     tables_exist="${tables_exist// /}"
 
     if [[ "${migration_count}" == "0" && "${tables_exist}" -gt 0 ]]; then
@@ -209,7 +179,7 @@ MIGSQL
         for sql_file in $(ls "${MIGRATION_DIR}"/*.sql 2>/dev/null | sort); do
             local fname
             fname=$(basename "${sql_file}")
-            psql_run_as_pm -c "INSERT INTO _migrations (filename) VALUES ('${fname}') ON CONFLICT (filename) DO NOTHING;" 2>/dev/null || true
+            psql_run_db -c "INSERT INTO _migrations (filename) VALUES ('${fname}') ON CONFLICT (filename) DO NOTHING;" 2>/dev/null || true
         done
     fi
 
@@ -221,7 +191,7 @@ MIGSQL
         fname=$(basename "${sql_file}")
 
         local already_applied
-        already_applied=$(psql_run_as_pm -t -A -c "SELECT COUNT(*) FROM _migrations WHERE filename='${fname}';" 2>/dev/null || echo "0")
+        already_applied=$(psql_run_db -t -A -c "SELECT COUNT(*) FROM _migrations WHERE filename='${fname}';" 2>/dev/null || echo "0")
         already_applied="${already_applied// /}"
 
         if [[ "${already_applied}" -gt 0 ]]; then
@@ -230,18 +200,15 @@ MIGSQL
         fi
 
         info "  Applying migration: ${fname}"
-        if psql_run_as_pm -f "${sql_file}"; then
+        if psql_run_db -f "${sql_file}"; then
-            psql_run_as_pm -c "INSERT INTO _migrations (filename) VALUES ('${fname}');" 2>/dev/null || true
+            psql_run_db -c "INSERT INTO _migrations (filename) VALUES ('${fname}');" 2>/dev/null || true
             applied=$((applied + 1))
         else
             error "  Failed to apply migration: ${fname}"
-            unset PGPASSWORD
             return 1
         fi
     done
 
-    unset PGPASSWORD
-
     if [[ "${applied}" -gt 0 ]]; then
         info "Applied ${applied} new migration(s), skipped ${skipped} already applied."
     else

frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "patch-manager-ui",
   "private": true,
-  "version": "1.1.10",
+  "version": "1.1.8",
   "type": "module",
   "scripts": {
     "dev": "vite",

scripts/build-package.sh

@@ -22,7 +22,7 @@ warn()  { echo -e "${YELLOW}[WARN]${NC}  $*"; }
 error() { echo -e "${RED}[ERROR]${NC} $*" >&2; exit 1; }
 
 PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-VERSION="1.1.10"
+VERSION="1.1.8"
 RELEASE="1"
 PKG_NAME="linux-patch-manager"
 DEB_NAME="${PKG_NAME}_${VERSION}-${RELEASE}_amd64.deb"