37 lines
1.4 KiB
Markdown
37 lines
1.4 KiB
Markdown
# OfficeCom Sentinel PostgreSQL
|
|
|
|
PostgreSQL is the private central store for endpoint reports. It is never
|
|
contacted directly by an endpoint; only n8n uses a database account.
|
|
|
|
## Provisioning
|
|
|
|
The production instance is deployed as the private Dockge stack documented in
|
|
[../dockge/README.md](../dockge/README.md). The bootstrap has already created
|
|
the database, schema, and restricted `ocsentinel_n8n` role.
|
|
|
|
For a separate future installation:
|
|
|
|
1. Create a database named `ocsentinel` on the private PostgreSQL server.
|
|
2. Apply `001_ocsentinel.sql` as a database administrator.
|
|
3. Create a non-superuser n8n login and grant only the necessary permissions:
|
|
|
|
```sql
|
|
GRANT USAGE ON SCHEMA ocsentinel TO ocsentinel_n8n;
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA ocsentinel TO ocsentinel_n8n;
|
|
GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA ocsentinel TO ocsentinel_n8n;
|
|
GRANT SELECT ON ocsentinel.current_device_status, ocsentinel.organization_summary TO ocsentinel_n8n;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA ocsentinel
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ocsentinel_n8n;
|
|
```
|
|
|
|
Keep the database host, password, and TLS settings only in n8n credentials.
|
|
They do not belong in Gitea, NinjaOne scripts, or endpoint configuration.
|
|
|
|
## Maintenance
|
|
|
|
Run monthly from n8n or an administrator session to remove expired replay tokens:
|
|
|
|
```sql
|
|
DELETE FROM ocsentinel.ingest_nonce WHERE expires_at < now();
|
|
```
|