31 lines
1.2 KiB
Markdown
31 lines
1.2 KiB
Markdown
# OfficeCom Sentinel PostgreSQL
|
|
|
|
PostgreSQL is the private central store for endpoint reports. It is never
|
|
contacted directly by an endpoint; only n8n uses a database account.
|
|
|
|
## Provisioning
|
|
|
|
1. Create a database named `ocsentinel` on the existing private PostgreSQL server.
|
|
2. Apply `001_ocsentinel.sql` as a database administrator.
|
|
3. Create a non-superuser n8n login and grant only the necessary permissions:
|
|
|
|
```sql
|
|
GRANT USAGE ON SCHEMA ocsentinel TO ocsentinel_n8n;
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA ocsentinel TO ocsentinel_n8n;
|
|
GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA ocsentinel TO ocsentinel_n8n;
|
|
GRANT SELECT ON ocsentinel.current_device_status, ocsentinel.organization_summary TO ocsentinel_n8n;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA ocsentinel
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ocsentinel_n8n;
|
|
```
|
|
|
|
Keep the database host, password, and TLS settings only in n8n credentials.
|
|
They do not belong in Gitea, NinjaOne scripts, or endpoint configuration.
|
|
|
|
## Maintenance
|
|
|
|
Run monthly from n8n or an administrator session to remove expired replay tokens:
|
|
|
|
```sql
|
|
DELETE FROM ocsentinel.ingest_nonce WHERE expires_at < now();
|
|
```
|