reorder GUC declarations

Aiven-Open · Feb 9, 2023 · 3b59fb3 · 3b59fb3
1 parent bd91e00
commit 3b59fb3
Showing 1 changed file with 14 additions and 11 deletions.
diff --git a/src/aiven_gatekeeper.c b/src/aiven_gatekeeper.c
@@ -754,7 +754,21 @@ void _PG_init(void)
                              NULL,
                              NULL);
 
+    // comma-separated list of allowed superuser roles (can be assigned superuser)
+    DefineCustomStringVariable("aiven.pg_security_agent_reserved_roles",
+                               "Comma-separated list of roles that can be assigned superuser",
+                               NULL,
+                               &allowed_superuser_roles,
+                               "postgres",         // default to postgres
+                               PGC_POSTMASTER,     // only at postmaster startup
+                               GUC_SUPERUSER_ONLY, // only show to superuser
+                               allowed_guc_change_allowed_superusers,
+                               NULL,
+                               NULL);
+
     // allow toggling of the security agent
+    // this variable definition should always be last, otherwise further defines
+    // stop working because the agent has defaulted to strict = on
     DefineCustomBoolVariable("aiven.pg_security_agent_strict",
                              "Toggle the agent into strict mode. Reserved actions are blocked regardless of context",
                              NULL,
@@ -766,17 +780,6 @@ void _PG_init(void)
                              NULL,
                              NULL);
 
-    // comma-separated list of allowed superuser roles (can be assigned superuser)
-    DefineCustomStringVariable("aiven.pg_security_agent_reserved_roles",
-                               "Comma-separated list of roles that can be assigned superuser",
-                               NULL,
-                               &allowed_superuser_roles,
-                               "postgres",              // default to postgres
-                               PGC_POSTMASTER,     // only at postmaster startup
-                               GUC_SUPERUSER_ONLY, // only show to superuser
-                               allowed_guc_change_allowed_superusers,
-                               NULL,
-                               NULL);
 
     if (set_reserved_oids())
     {