Add production support for SQLite

server/migrations/models/0_20261022232629_init.py

@@ -3,7 +3,223 @@ from tortoise import BaseDBAsyncClient
 RUN_IN_TRANSACTION = True
 
 
+# SQLite production support was introduced after migration 4. Bootstrap new
+# SQLite databases directly at that current schema; migrations 1-4 are no-ops
+# on SQLite. PostgreSQL retains the historical migration path below.
+SQLITE_UPGRADE = """
+CREATE TABLE IF NOT EXISTS "api_token" (
+    "id" CHAR(36) NOT NULL PRIMARY KEY,
+    "user_issuer" VARCHAR(2048) NOT NULL,
+    "user_sub" VARCHAR(255) NOT NULL,
+    "name" VARCHAR(100) NOT NULL,
+    "token_prefix" VARCHAR(16) NOT NULL,
+    "token_hash" VARCHAR(64) NOT NULL UNIQUE,
+    "created_at" TIMESTAMP NOT NULL,
+    "last_used_at" TIMESTAMP,
+    "expires_at" DATE
+);
+CREATE INDEX IF NOT EXISTS "idx_api_token_user_is_612f0d" ON "api_token" ("user_issuer", "user_sub");
+CREATE TABLE IF NOT EXISTS "ocsp_snapshot" (
+    "ca_id" CHAR(36) NOT NULL PRIMARY KEY,
+    "dirty" INT NOT NULL,
+    "published_at" TIMESTAMP,
+    "last_error" TEXT,
+    "updated_at" TIMESTAMP NOT NULL
+);
+CREATE INDEX IF NOT EXISTS "idx_ocsp_snapsh_dirty_a8d440" ON "ocsp_snapshot" ("dirty");
+CREATE TABLE IF NOT EXISTS "app_user" (
+    "id" CHAR(36) NOT NULL PRIMARY KEY,
+    "issuer" VARCHAR(2048) NOT NULL,
+    "sub" VARCHAR(255) NOT NULL,
+    "display_name" VARCHAR(200) NOT NULL,
+    "name" VARCHAR(255),
+    "family_name" VARCHAR(255),
+    "given_name" VARCHAR(255),
+    "middle_name" VARCHAR(255),
+    "nickname" VARCHAR(255),
+    "preferred_username" VARCHAR(255),
+    "profile" VARCHAR(2048),
+    "picture" VARCHAR(2048),
+    "website" VARCHAR(2048),
+    "gender" VARCHAR(100),
+    "birthdate" VARCHAR(32),
+    "zoneinfo" VARCHAR(100),
+    "locale" VARCHAR(100),
+    "updated_at" BIGINT,
+    "created_at" TIMESTAMP NOT NULL,
+    "last_seen_at" TIMESTAMP NOT NULL,
+    CONSTRAINT "uid_app_user_issuer_d243fe" UNIQUE ("issuer", "sub")
+);
+CREATE TABLE IF NOT EXISTS "vault" (
+    "id" CHAR(36) NOT NULL PRIMARY KEY,
+    "owner_issuer" VARCHAR(2048) NOT NULL,
+    "owner_sub" VARCHAR(255) NOT NULL,
+    "name" VARCHAR(200) NOT NULL,
+    "description" TEXT NOT NULL,
+    "settings" JSON NOT NULL,
+    "version" INT NOT NULL,
+    "created_at" TIMESTAMP NOT NULL,
+    "updated_at" TIMESTAMP NOT NULL
+);
+CREATE INDEX IF NOT EXISTS "idx_vault_owner_i_a035fb" ON "vault" ("owner_issuer", "owner_sub");
+CREATE TABLE IF NOT EXISTS "key" (
+    "id" CHAR(36) NOT NULL PRIMARY KEY,
+    "name" VARCHAR(200) NOT NULL,
+    "comment" TEXT NOT NULL,
+    "source" VARCHAR(20) NOT NULL,
+    "key_type" VARCHAR(20) NOT NULL,
+    "key_size" INT,
+    "curve" VARCHAR(100),
+    "public_der" BLOB NOT NULL,
+    "public_key_sha256" VARCHAR(64) NOT NULL,
+    "private_der" BLOB,
+    "private_nonce" BLOB,
+    "has_private" INT NOT NULL,
+    "version" INT NOT NULL,
+    "search_text" TEXT NOT NULL,
+    "created_at" TIMESTAMP NOT NULL,
+    "updated_at" TIMESTAMP NOT NULL,
+    "vault_id" CHAR(36) NOT NULL REFERENCES "vault" ("id") ON DELETE CASCADE,
+    CONSTRAINT "uid_key_vault_i_e0ffb5" UNIQUE ("vault_id", "public_key_sha256")
+);
+CREATE INDEX IF NOT EXISTS "idx_key_public__eba47e" ON "key" ("public_key_sha256");
+CREATE INDEX IF NOT EXISTS "idx_key_vault_i_a6f27f" ON "key" ("vault_id", "name");
+CREATE INDEX IF NOT EXISTS "idx_key_vault_i_c2e997" ON "key" ("vault_id", "key_type");
+CREATE TABLE IF NOT EXISTS "request" (
+    "id" CHAR(36) NOT NULL PRIMARY KEY,
+    "name" VARCHAR(200) NOT NULL,
+    "comment" TEXT NOT NULL,
+    "source" VARCHAR(20) NOT NULL,
+    "subject_der" BLOB NOT NULL,
+    "req_der" BLOB NOT NULL,
+    "public_key_der" BLOB NOT NULL,
+    "request_sha256" VARCHAR(64) NOT NULL,
+    "signed" INT NOT NULL,
+    "signed_at" TIMESTAMP,
+    "attributes" JSON NOT NULL,
+    "version" INT NOT NULL,
+    "search_text" TEXT NOT NULL,
+    "created_at" TIMESTAMP NOT NULL,
+    "updated_at" TIMESTAMP NOT NULL,
+    "key_id" CHAR(36) REFERENCES "key" ("id") ON DELETE SET NULL,
+    "vault_id" CHAR(36) NOT NULL REFERENCES "vault" ("id") ON DELETE CASCADE,
+    CONSTRAINT "uid_request_vault_i_b661f4" UNIQUE ("vault_id", "request_sha256")
+);
+CREATE INDEX IF NOT EXISTS "idx_request_request_fad061" ON "request" ("request_sha256");
+CREATE INDEX IF NOT EXISTS "idx_request_vault_i_346e22" ON "request" ("vault_id", "name");
+CREATE INDEX IF NOT EXISTS "idx_request_vault_i_2cd9ef" ON "request" ("vault_id", "signed");
+CREATE TABLE IF NOT EXISTS "certificate" (
+    "id" CHAR(36) NOT NULL PRIMARY KEY,
+    "name" VARCHAR(200) NOT NULL,
+    "comment" TEXT NOT NULL,
+    "source" VARCHAR(20) NOT NULL,
+    "serial_hex" VARCHAR(128) NOT NULL,
+    "subject_der" BLOB NOT NULL,
+    "issuer_der" BLOB NOT NULL,
+    "subject_hash" VARCHAR(64) NOT NULL,
+    "issuer_hash" VARCHAR(64) NOT NULL,
+    "not_before" TIMESTAMP NOT NULL,
+    "not_after" TIMESTAMP NOT NULL,
+    "no_expiration" INT NOT NULL,
+    "is_ca" INT NOT NULL,
+    "path_length" INT,
+    "cert_der" BLOB NOT NULL,
+    "public_key_der" BLOB NOT NULL,
+    "signature_algorithm" VARCHAR(100) NOT NULL,
+    "fingerprint_md5" VARCHAR(32) NOT NULL,
+    "fingerprint_sha1" VARCHAR(40) NOT NULL,
+    "fingerprint_sha256" VARCHAR(64) NOT NULL,
+    "version" INT NOT NULL,
+    "search_text" TEXT NOT NULL,
+    "created_at" TIMESTAMP NOT NULL,
+    "updated_at" TIMESTAMP NOT NULL,
+    "issuer_id" CHAR(36) REFERENCES "certificate" ("id") ON DELETE SET NULL,
+    "key_id" CHAR(36) REFERENCES "key" ("id") ON DELETE SET NULL,
+    "request_id" CHAR(36) REFERENCES "request" ("id") ON DELETE SET NULL,
+    "vault_id" CHAR(36) NOT NULL REFERENCES "vault" ("id") ON DELETE CASCADE,
+    CONSTRAINT "uid_certificate_vault_i_842384" UNIQUE ("vault_id", "fingerprint_sha256")
+);
+CREATE INDEX IF NOT EXISTS "idx_certificate_serial__787fd1" ON "certificate" ("serial_hex");
+CREATE INDEX IF NOT EXISTS "idx_certificate_subject_ed411b" ON "certificate" ("subject_hash");
+CREATE INDEX IF NOT EXISTS "idx_certificate_issuer__b8daa0" ON "certificate" ("issuer_hash");
+CREATE INDEX IF NOT EXISTS "idx_certificate_is_ca_906cf3" ON "certificate" ("is_ca");
+CREATE INDEX IF NOT EXISTS "idx_certificate_fingerp_12be2c" ON "certificate" ("fingerprint_sha256");
+CREATE INDEX IF NOT EXISTS "idx_certificate_vault_i_18b9a0" ON "certificate" ("vault_id", "name");
+CREATE INDEX IF NOT EXISTS "idx_certificate_vault_i_dfb18f" ON "certificate" ("vault_id", "issuer_id");
+CREATE INDEX IF NOT EXISTS "idx_certificate_vault_i_eded8f" ON "certificate" ("vault_id", "not_after");
+CREATE TABLE IF NOT EXISTS "certificate_revocation" (
+    "id" CHAR(36) NOT NULL PRIMARY KEY,
+    "serial_hex" VARCHAR(128) NOT NULL,
+    "revoked_at" TIMESTAMP NOT NULL,
+    "invalidity_date" TIMESTAMP,
+    "reason" VARCHAR(50) NOT NULL,
+    "crl_number" INT NOT NULL,
+    "created_at" TIMESTAMP NOT NULL,
+    "ca_id" CHAR(36) NOT NULL REFERENCES "certificate" ("id") ON DELETE CASCADE,
+    CONSTRAINT "uid_certificate_ca_id_1c9aa5" UNIQUE ("ca_id", "serial_hex")
+);
+CREATE INDEX IF NOT EXISTS "idx_certificate_serial__8fa20f" ON "certificate_revocation" ("serial_hex");
+CREATE TABLE IF NOT EXISTS "crl" (
+    "id" CHAR(36) NOT NULL PRIMARY KEY,
+    "name" VARCHAR(200) NOT NULL,
+    "comment" TEXT NOT NULL,
+    "source" VARCHAR(20) NOT NULL,
+    "crl_der" BLOB NOT NULL,
+    "crl_hash" VARCHAR(64) NOT NULL,
+    "crl_number" INT,
+    "last_update" TIMESTAMP NOT NULL,
+    "next_update" TIMESTAMP,
+    "revoked_count" INT NOT NULL,
+    "signature_algorithm" VARCHAR(100) NOT NULL,
+    "search_text" TEXT NOT NULL,
+    "created_at" TIMESTAMP NOT NULL,
+    "updated_at" TIMESTAMP NOT NULL,
+    "issuer_id" CHAR(36) REFERENCES "certificate" ("id") ON DELETE SET NULL,
+    "vault_id" CHAR(36) NOT NULL REFERENCES "vault" ("id") ON DELETE CASCADE,
+    CONSTRAINT "uid_crl_vault_i_e5461a" UNIQUE ("vault_id", "crl_hash")
+);
+CREATE INDEX IF NOT EXISTS "idx_crl_crl_has_c44d61" ON "crl" ("crl_hash");
+CREATE INDEX IF NOT EXISTS "idx_crl_vault_i_6af15c" ON "crl" ("vault_id", "name");
+CREATE INDEX IF NOT EXISTS "idx_crl_vault_i_576344" ON "crl" ("vault_id", "issuer_id");
+CREATE TABLE IF NOT EXISTS "template" (
+    "id" CHAR(36) NOT NULL PRIMARY KEY,
+    "name" VARCHAR(200) NOT NULL,
+    "comment" TEXT NOT NULL,
+    "source" VARCHAR(20) NOT NULL,
+    "subject" JSON NOT NULL,
+    "settings" JSON NOT NULL,
+    "version" INT NOT NULL,
+    "search_text" TEXT NOT NULL,
+    "created_at" TIMESTAMP NOT NULL,
+    "updated_at" TIMESTAMP NOT NULL,
+    "vault_id" CHAR(36) NOT NULL REFERENCES "vault" ("id") ON DELETE CASCADE
+);
+CREATE INDEX IF NOT EXISTS "idx_template_vault_i_18d8f5" ON "template" ("vault_id", "name");
+CREATE TABLE IF NOT EXISTS "authority" (
+    "id" CHAR(36) NOT NULL PRIMARY KEY,
+    "template_key" VARCHAR(64),
+    "crl_expire" TIMESTAMP,
+    "crl_number" INT NOT NULL,
+    "crl_days" INT NOT NULL,
+    "tls_auth_key" BLOB,
+    "tls_auth_key_nonce" BLOB,
+    "created_at" TIMESTAMP NOT NULL,
+    "updated_at" TIMESTAMP NOT NULL,
+    "template_id" CHAR(36) REFERENCES "template" ("id") ON DELETE SET NULL,
+    "certificate_id" CHAR(36) NOT NULL UNIQUE REFERENCES "certificate" ("id") ON DELETE CASCADE
+);
+CREATE TABLE IF NOT EXISTS "aerich" (
+    "id" INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,
+    "version" VARCHAR(255) NOT NULL,
+    "app" VARCHAR(100) NOT NULL,
+    "content" JSON NOT NULL
+);
+"""
+
+
 async def upgrade(db: BaseDBAsyncClient) -> str:
+    if db.capabilities.dialect == "sqlite":
+        return SQLITE_UPGRADE
     return """
         CREATE TABLE IF NOT EXISTS "api_token" (
     "id" UUID NOT NULL PRIMARY KEY,

server/migrations/models/1_20261023030253_certificate_no_expiration.py

@@ -4,11 +4,16 @@ RUN_IN_TRANSACTION = True
 
 
 async def upgrade(db: BaseDBAsyncClient) -> str:
+    # Migration 0 bootstraps SQLite at the current schema.
+    if db.capabilities.dialect == "sqlite":
+        return "SELECT 1;"
     return """
         ALTER TABLE "certificate" ADD "no_expiration" BOOL NOT NULL DEFAULT False;"""
 
 
 async def downgrade(db: BaseDBAsyncClient) -> str:
+    if db.capabilities.dialect == "sqlite":
+        return "SELECT 1;"
     return """
         ALTER TABLE "certificate" DROP COLUMN "no_expiration";"""
 

server/migrations/models/2_20261023030349_authority_template_key.py

@@ -4,11 +4,16 @@ RUN_IN_TRANSACTION = True
 
 
 async def upgrade(db: BaseDBAsyncClient) -> str:
+    # Migration 0 bootstraps SQLite at the current schema.
+    if db.capabilities.dialect == "sqlite":
+        return "SELECT 1;"
     return """
         ALTER TABLE "authority" ADD "template_key" VARCHAR(64);"""
 
 
 async def downgrade(db: BaseDBAsyncClient) -> str:
+    if db.capabilities.dialect == "sqlite":
+        return "SELECT 1;"
     return """
         ALTER TABLE "authority" DROP COLUMN "template_key";"""
 

server/migrations/models/3_20261023083400_ocsp_snapshot.py

@@ -4,6 +4,9 @@ RUN_IN_TRANSACTION = True
 
 
 async def upgrade(db: BaseDBAsyncClient) -> str:
+    # Migration 0 bootstraps SQLite at the current schema.
+    if db.capabilities.dialect == "sqlite":
+        return "SELECT 1;"
     return """
         CREATE TABLE IF NOT EXISTS "ocsp_snapshot" (
     "ca_id" UUID NOT NULL PRIMARY KEY,
@@ -17,6 +20,8 @@ COMMENT ON TABLE "ocsp_snapshot" IS 'Publication state for one CA''s OCSP status
 
 
 async def downgrade(db: BaseDBAsyncClient) -> str:
+    if db.capabilities.dialect == "sqlite":
+        return "SELECT 1;"
     return """
         DROP TABLE IF EXISTS "ocsp_snapshot";"""
 

server/migrations/models/4_20261025081154_oidc_issuer_identity.py

@@ -7,6 +7,9 @@ RUN_IN_TRANSACTION = True
 
 
 async def upgrade(db: BaseDBAsyncClient) -> str:
+    # Migration 0 bootstraps SQLite at the current schema.
+    if db.capabilities.dialect == "sqlite":
+        return "SELECT 1;"
     return """
         DROP INDEX IF EXISTS "idx_vault_owner_s_cdc1f8";
         ALTER TABLE "app_user" DROP CONSTRAINT IF EXISTS "app_user_sub_key";
@@ -21,6 +24,8 @@ async def upgrade(db: BaseDBAsyncClient) -> str:
 
 
 async def downgrade(db: BaseDBAsyncClient) -> str:
+    if db.capabilities.dialect == "sqlite":
+        return "SELECT 1;"
     return """
         DROP INDEX IF EXISTS "idx_vault_owner_i_a035fb";
         DROP INDEX IF EXISTS "uid_app_user_issuer_d243fe";