feat(replica): redaction via dbt-masking manifests + postgresql_anonymizer

[passcod]

Summary

Adds a new spec.redaction field to PostgresPhysicalReplica. When set, after each restore reaches the Ready phase the operator fetches a dbt-shaped masking manifest, installs the postgresql_anonymizer extension into the restore Pod, applies a SECURITY LABEL per masked column, runs anon.anonymize_database(), and re-enables read-only — all before allowing the switchover to make the new restore live.

The contract follows Tamanu's masking spec verbatim: short-form (masking: email) and extended-form (masking: { kind: integer, range: "20-50" }) are both accepted, all canonical kinds are handled (truncate, date, datetime, text, string, email, name, phone, place, url, zero, empty, nil, default, integer, float, money), and unknown kinds are tolerated as partial errors. Nulls are preserved via CASE wrappers; type-dependent kinds (zero, empty, default, nil) consult information_schema.columns + pg_attrdef so they dispatch correctly across text / numeric / bytea / json types. Mask-to-anon mapping was cross-checked against the dalibo docs.

The extension is installed by the postgres container's own command wrapper: it runs as root, apt-installs postgresql_anonymizer_$N from Dalibo Labs (cached on the restore PVC at /pgdata/.anon-cache/ so subsequent pod starts skip the network), copies the files into /usr/share/postgresql/$N/extension and /usr/lib/postgresql/$N/lib of its writable layer, then drops to UID 999 via gosu postgres before execing postgres. No PG-version gate — works on any major the operator otherwise supports.

CRD changes

New spec field on PostgresPhysicalReplica:

spec:
  redaction:
    manifestUrl: "https://docs.data.bes.au/tamanu/v{version}/manifest.json"
    versionQuery: "SELECT value FROM local_system_facts WHERE key = 'currentVersion'"
    versionFallbackToBase: true

New status fields: redactionPhase (active → complete/partial/failed: …), redactionVersion, redactionColumnsApplied.

Behaviour

• Writable during redaction, read-only after — operator flips default_transaction_read_only = on at the DB level and demotes the analytics user back to NOSUPERUSER + pg_read_all_data when spec.readOnly is true.
• Per-statement-error tolerance — missing columns / unknown kinds / non-nullable nil etc. don't abort; the run reports partial with a count.
• failed: is sticky — broken manifests don't loop; the next scheduled restore clears the phase.
• Sweep gates on redaction settling — same pattern as schemaMigrationPhase. Schema migration runs after redaction so persistent_schemas views regenerate against redacted source data.

Tests

• ~40 new unit tests covering manifest parsing (both shapes, table-level truncate, missing schema/name, unknown kinds), range parsing (last-dash split, floats), fragment building for every canonical kind including type-dispatched cases, spec validation, version resolution, and restore Pod wiring (including a PG-16 case to confirm there's no version gate).
• New end-to-end integration test (tests/redaction.rs) and matrix entry. The CI workflow builds a kopia snapshot fixture with a Tamanu-shaped local_system_facts table + a users table + sync_lookup, deploys an in-namespace nginx-served static manifest, and asserts each mask kind took effect, sync_lookup was truncated, unmarked columns kept their values, read-only was re-enabled, and analytics was demoted from SUPERUSER.

Open items

• Network dependency on Dalibo Labs apt repo — the first start of each restore Pod hits the repo; subsequent starts use the PVC cache. The Pod fails to start if the repo is unreachable.

🤖 Generated with Claude Code