element-hq / element-hq/synapse

Separating database users for schema management and application runtime

Open
#18,929 1 comment 1 reaction 0 assignees View on GitHub
A-Database O-Uncommon Security T-Enhancement
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

Hello,

We are using Synapse in our company, and for security and traceability reasons, we would like to configure Synapse with two different database users:

- Admin DB user: with full privileges (including schema modification). This user would only be used during installation and during schema upgrade operations when upgrading Synapse.

- Application DB user: with restricted privileges (only data access — no schema modification roles). This user would be used by the running Synapse application in production.

I also tested a possible workaround for this problem by:

- Running an external job with the admin DB user to perform the schema upgrade.

- Configuring Synapse itself to run with the restricted DB user (no schema modification privileges).

However, when I tried this approach, I realized that Synapse still requires a DB user with full privileges (including schema modifications) in order to start properly.

Could you please consider supporting this request of using two different DB users, or suggest an alternative temporary solution to achieve a similar separation?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.