kevinveenbirkenbachandClaude Opus 5 c0b3ac9462 fix(svc-db-postgres): run the hba swap once, not twice ...

The script carried its procedure twice. A retry loop was added around the original
linear body, and the body below it stayed: a second pg_hba backup, a second
`trap ... EXIT`, a second prepended scram line, a second reload, two more auth_test
rounds and a second ALTER USER. Every invocation therefore rewrote the host-based
auth file twice and set the password twice.

It worked, because each step is idempotent, and it cost every call an extra pass
with two auth probes that wait up to thirty seconds each.

The subtle part is the output. The loop set `result` and never printed it; what the
caller read came from the second body, which echoed [CHANGED] or [UNCHANGED] from its
own pre_ok/post_ok. Deleting the duplicate alone would have left the script silent and
`changed_when: '[CHANGED]' in stdout` permanently false. The verdict now comes from
the pass that actually measured, through `echo "$result"`.

164 lines to 110. The contract is unchanged: [CHANGED] / [UNCHANGED] on stdout,
[FAIL] on stderr with exit 1.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-31 21:55:10 +02:00

..

boot-entrypoint.sh

…

dump_pg_hba.sh

…

set_postgres_superuser_password.sh

fix(svc-db-postgres): run the hba swap once, not twice

2026-08-31 21:55:10 +02:00