Skip to content

Security: victormends/windows-postgres-deployment-installer

Security

SECURITY.md

Security Policy

This project performs privileged Windows deployment operations. It should be used only by an operator who understands the target machine, PostgreSQL service layout, firewall rules, and backup/restore expectations.

Supported Use

  • Windows workstation or small-server PostgreSQL bootstrap.
  • Operator-reviewed deployments where a private config.ps1 is prepared from config.example.ps1.
  • Local PostgreSQL ZIP installation, service registration, configuration, optional restore, firewall setup, and optional SMB share setup.

Safety Boundaries

  • The installer and uninstaller must be run from an elevated PowerShell session.
  • config.ps1 is intentionally ignored by Git and may contain private paths, service names, restore locations, ports, and share settings.
  • The installer may create or replace PostgreSQL service registration, data directories, firewall rules, registry metadata, and SMB share permissions.
  • The uninstaller is destructive and removes configured service, registry, PostgreSQL files, and application files after explicit confirmation.
  • Temporary restore acceleration disables durability settings only around the restore step and then attempts to restore the original configuration.

Before Using

  1. Test on a disposable VM or non-production workstation.
  2. Review every value in config.ps1, especially install/data paths and share settings.
  3. Confirm the PostgreSQL binary ZIP and optional backup file are trusted.
  4. Keep independent backups before running restore or uninstall operations.
  5. Review Windows firewall and SMB share impact with the local operator.

Non-Goals

  • This is not a cloud deployment system.
  • This is not a zero-touch production orchestrator.
  • This is not a substitute for backup policy, restore testing, or access review.
  • This public version intentionally excludes private application binaries and site-specific deployment data.

Reporting Issues

Open a GitHub issue with sanitized logs and configuration snippets. Do not share customer names, real backup paths, passwords, internal hostnames, or proprietary application artifacts.

There aren't any published security advisories