fix(datatables): hold the fork lock across a rename's settings copy

Fork cleanup of the old id could otherwise drop a copy the renamed workspace goes on using. Also
states the authorization contract of the instance database drop helpers.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

backend/.sqlx/query-71ee2cb6661cca1fa4d8874a7f6d368347c59f36fd87df6dc7996152ccb84af0.json

@@ -0,0 +1,38 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT id, name, enabled, pwd FROM datatable_role",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "name",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "enabled",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 3,
+        "name": "pwd",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      true
+    ]
+  },
+  "hash": "71ee2cb6661cca1fa4d8874a7f6d368347c59f36fd87df6dc7996152ccb84af0"
+}

backend/.sqlx/query-79799b5a2e499df6c28e286c42b9ad2db940c2455ab19cc95e5198baf96d5629.json

@@ -0,0 +1,29 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT ws.workspace_id AS \"workspace_id!\", dt.key AS \"datatable!\"\n        FROM workspace_settings ws\n        JOIN workspace w ON w.id = ws.workspace_id AND w.deleted = false\n        CROSS JOIN LATERAL jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) dt\n        WHERE ws.workspace_id <> $1\n          AND dt.value->'database'->>'resource_type' = 'instance'\n          AND dt.value->'database'->>'resource_path' = $2\n        ORDER BY ws.workspace_id, dt.key\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "workspace_id!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "datatable!",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      null
+    ]
+  },
+  "hash": "79799b5a2e499df6c28e286c42b9ad2db940c2455ab19cc95e5198baf96d5629"
+}

backend/.sqlx/query-86af9d51a158ea5cb6161461ecddf2a63695f8cbf8af648da5a0a77a5b9d02ba.json

@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO datatable_role (id, name, enabled, pwd) VALUES ($1, $2, $3, $4)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Bool",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "86af9d51a158ea5cb6161461ecddf2a63695f8cbf8af648da5a0a77a5b9d02ba"
+}

backend/.sqlx/query-b9842d2d8abf382bd82d8fa1de012373638be391f884f81dc387ffc465badac6.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT jsonb_object_keys(value->'databases') FROM global_settings\n         WHERE name = 'custom_instance_pg_databases'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "jsonb_object_keys",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "b9842d2d8abf382bd82d8fa1de012373638be391f884f81dc387ffc465badac6"
+}

backend/.sqlx/query-d48ca62c86b1af7a9dd2450c1c28dc45020a2a553d8874c49f9eafedea5a9d40.json

@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT dt.key AS \"datatable!\"\n           FROM workspace_settings ws\n           CROSS JOIN LATERAL jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) dt\n           WHERE ws.workspace_id = $1\n             AND dt.key <> $2\n             AND NOT dt.value ? 'permissions'\n             AND dt.value->'database'->>'resource_type' = 'instance'\n             AND dt.value->'database'->>'resource_path' = $3\n           ORDER BY dt.key",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "datatable!",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "d48ca62c86b1af7a9dd2450c1c28dc45020a2a553d8874c49f9eafedea5a9d40"
+}

backend/Cargo.lock

@@ -15653,7 +15653,6 @@ dependencies = [
  "pin-project-lite",
  "pkcs1",
  "postgres-native-tls 0.5.3",
- "postgres-protocol",
  "prometheus",
  "quick_cache",
  "rand 0.9.0",

backend/Cargo.toml

@@ -624,7 +624,6 @@ wasm-bindgen-test = "^0"
 convert_case = "0.6.0"
 getrandom = "0.2"
 tokio-postgres = {version = "^0.7", features = ["array-impls", "with-serde_json-1", "with-chrono-0_4", "with-uuid-1", "with-bit-vec-0_6"]}
-postgres-protocol = "0.6"
 rust-postgres = { package = "tokio-postgres", git = "https://github.com/MaterializeInc/rust-postgres", rev = "78c1222577bb091d69bc22b1bc7ad01c14675abe"}
 rust-postgres-native-tls = { package = "postgres-native-tls", git = "https://github.com/MaterializeInc/rust-postgres", features = ["runtime"], rev = "78c1222577bb091d69bc22b1bc7ad01c14675abe" }
 bit-vec = "=0.6.3"

backend/ee-repo-ref.txt

@@ -1 +1 @@
-151be033ea2bf2f768f381a8cd3b888bdd366cf9
+c2e43f5b5ff753d339b70e232fd17b6ffecb054d

backend/migrations/20260917133824_datatable_role_cluster.down.sql

@@ -1,22 +0,0 @@
--- Roles on the external cluster are live logins there; dropping the column would forget them.
-LOCK TABLE datatable_role;
-DO $$
-BEGIN
-    IF EXISTS (SELECT 1 FROM datatable_role WHERE cluster <> 'instance') THEN
-        RAISE EXCEPTION 'datatable_role holds roles on the external instance cluster. Delete them in instance settings first.';
-    END IF;
-    -- Before this, only data tables on Windmill's own cluster could be under roles, and a role
-    -- block left with just `admin` survives deleting every external role.
-    IF EXISTS (
-        SELECT 1 FROM workspace_settings ws,
-            jsonb_each(CASE WHEN jsonb_typeof(ws.datatable->'datatables') = 'object'
-                THEN ws.datatable->'datatables' ELSE '{}'::jsonb END) dt
-        WHERE dt.value->'database'->>'resource_type' = 'external_instance'
-          AND dt.value ? 'permissions'
-    ) THEN
-        RAISE EXCEPTION 'external instance data tables are still under roles. Turn their roles off first.';
-    END IF;
-END $$;
-ALTER TABLE datatable_role DROP CONSTRAINT datatable_role_cluster_name_key;
-ALTER TABLE datatable_role ADD CONSTRAINT datatable_role_name_key UNIQUE (name);
-ALTER TABLE datatable_role DROP COLUMN cluster;

backend/migrations/20260917133824_datatable_role_cluster.up.sql

@@ -1,8 +0,0 @@
--- A data table role is a Postgres login on one cluster: Windmill's own ('instance'), or the external
--- instance cluster ('external_instance'). Role names are the cluster's own key, so they are unique
--- per cluster rather than across the instance.
-ALTER TABLE datatable_role
-    ADD COLUMN cluster VARCHAR(20) NOT NULL DEFAULT 'instance'
-        CHECK (cluster IN ('instance', 'external_instance'));
-ALTER TABLE datatable_role DROP CONSTRAINT datatable_role_name_key;
-ALTER TABLE datatable_role ADD CONSTRAINT datatable_role_cluster_name_key UNIQUE (cluster, name);

backend/windmill-api-integration-tests/tests/datatable_roles.rs

@@ -391,11 +391,7 @@ async fn concurrent_role_creations_both_survive(db: Pool<Postgres>) -> anyhow::R
         assert_eq!(a.0, 200, "{}", a.1);
         assert_eq!(b.0, 200, "{}", b.1);
 
-        let catalog = windmill_common::datatable_roles::read_role_catalog(
-            &db,
-            windmill_common::datatable_roles::DatatableRoleCluster::Instance,
-        )
-        .await?;
+        let catalog = windmill_common::datatable_roles::read_role_catalog(&db).await?;
         let recorded: Vec<&str> = catalog.values().map(|r| r.name.as_str()).collect();
         for name in &names {
             assert!(
@@ -464,11 +460,7 @@ async fn a_role_delete_that_fails_part_way_leaves_the_role_disabled(
         let body = resp.text().await?;
         assert_eq!(status, 400, "{body}");
 
-        let catalog = windmill_common::datatable_roles::read_role_catalog(
-            &db,
-            windmill_common::datatable_roles::DatatableRoleCluster::Instance,
-        )
-        .await?;
+        let catalog = windmill_common::datatable_roles::read_role_catalog(&db).await?;
         let role = catalog
             .get(&id)
             .expect("a failed delete keeps the entry to retry");

backend/windmill-api-settings/src/lib.rs

@@ -42,7 +42,6 @@ use axum::{
     routing::{get, post},
     Json, Router,
 };
-use serde_json::json;
 
 use serde::{Deserialize, Serialize};
 use windmill_ai::ai_cache::bump_instance_ai_config_revision;
@@ -60,7 +59,7 @@ use windmill_common::{
     global_settings::{
         AI_CONFIG_SETTING, APP_WORKSPACED_ROUTE_SETTING, AUTOMATE_USERNAME_CREATION_SETTING,
         CRITICAL_ALERT_MUTE_UI_SETTING, CUSTOM_TAGS_SETTING, DEFAULT_TAGS_WORKSPACES_SETTING,
-        DISABLE_HUB_SETTING, EMAIL_DOMAIN_SETTING, ENV_SETTINGS, EXTERNAL_INSTANCE_PG_SETTING,
+        DISABLE_HUB_SETTING, EMAIL_DOMAIN_SETTING, ENV_SETTINGS,
         GITHUB_APP_WEBHOOK_BASE_URL_SETTING, HTTP_ROUTE_DEFAULT_ALLOWED_ORIGINS_SETTING,
         HTTP_ROUTE_WORKSPACED_ROUTE_SETTING, HUB_ACCESSIBLE_URL_SETTING, HUB_BASE_URL_SETTING,
         INSTANCE_BANNER_SETTING, MAX_RETENTION_OVERRIDE_WORKSPACES,
@@ -168,22 +167,6 @@ pub fn global_service() -> Router {
             "/refresh_custom_instance_user_pwd",
             post(refresh_custom_instance_user_pwd),
         )
-        .route(
-            "/external_instance_pg/status",
-            get(get_external_instance_pg_status),
-        )
-        .route(
-            "/external_instance_pg/setup",
-            post(setup_external_instance_pg),
-        )
-        .route(
-            "/external_instance_pg/databases",
-            get(list_external_instance_pg_databases),
-        )
-        .route(
-            "/external_instance_pg/databases/{name}",
-            post(create_external_instance_pg_database).delete(drop_external_instance_pg_database),
-        )
         .route(
             "/setup_custom_instance_pg_database/{name}",
             post(setup_custom_instance_pg_database),
@@ -893,14 +876,6 @@ pub async fn set_global_setting_internal(
         )));
     }
 
-    if key == EXTERNAL_INSTANCE_PG_SETTING {
-        return windmill_common::external_instance_pg::write_external_instance_pg_setting(
-            db,
-            Some(&value),
-        )
-        .await;
-    }
-
     run_setting_pre_write_hook(db, &key, &value).await?;
 
     match value {
@@ -1282,7 +1257,7 @@ async fn set_instance_config(
     let desired_map = desired.global_settings.to_settings_map();
     if !desired_map.is_empty() {
         let current_map = current.global_settings.to_settings_map();
-        let mut settings_diff =
+        let settings_diff =
             instance_config::diff_global_settings(&current_map, &desired_map, ApplyMode::Merge);
         let ai_config_changed = settings_diff
             .upserts
@@ -1311,15 +1286,8 @@ async fn set_instance_config(
         }
 
         for (key, value) in &settings_diff.upserts {
-            if key != EXTERNAL_INSTANCE_PG_SETTING {
-                run_setting_pre_write_hook(&db, key, value).await?;
-            }
+            run_setting_pre_write_hook(&db, key, value).await?;
         }
-        windmill_common::external_instance_pg::write_external_instance_pg_from_diff(
-            &db,
-            &mut settings_diff,
-        )
-        .await?;
 
         instance_config::apply_settings_diff(&db, &settings_diff)
             .await
@@ -1720,7 +1688,40 @@ async fn list_custom_instance_pg_databases(
             ))
         })?;
 
-    if windmill_api_auth::is_super_admin_authed(&db, &authed).await? {
+    if !windmill_api_auth::is_super_admin_authed(&db, &authed).await? {
+        // A fork copy's name gives away the workspace it was reserved for, so every pending fork on
+        // the instance would be listed. Kept for members of that workspace, and wherever the
+        // caller's workspaces use it, e.g. the fork it was finalized into.
+        let reserved_visible: BTreeSet<String> = sqlx::query_scalar(
+            r#"SELECT e.k FROM global_settings gs
+               CROSS JOIN LATERAL jsonb_each(gs.value->'databases') AS e(k, v)
+               WHERE gs.name = 'custom_instance_pg_databases' AND e.v->>'workspace_id' IS NOT NULL
+                 AND (EXISTS (SELECT 1 FROM usr WHERE usr.email = $1
+                                AND usr.workspace_id = e.v->>'workspace_id')
+                   OR EXISTS (SELECT 1 FROM usr JOIN workspace_settings ws
+                                ON ws.workspace_id = usr.workspace_id
+                              CROSS JOIN LATERAL jsonb_each(
+                                  CASE WHEN jsonb_typeof(ws.datatable->'datatables') = 'object'
+                                      THEN ws.datatable->'datatables' ELSE '{}'::jsonb END) dt
+                              WHERE usr.email = $1
+                                AND dt.value->'database'->>'resource_type' = 'instance'
+                                AND dt.value->'database'->>'resource_path' = e.k))"#,
+        )
+        .bind(&authed.email)
+        .fetch_all(&db)
+        .await?
+        .into_iter()
+        .collect();
+        result.retain(|dbname, entry| {
+            entry.workspace_id.is_none() || reserved_visible.contains(dbname)
+        });
+        // Which workspace reserved a copy is still only for superadmins.
+        for entry in result.values_mut() {
+            entry.workspace_id = None;
+        }
+        return Ok(Json(result));
+    }
+    {
         // Enrich each database with the list of workspaces referencing it through
         // either a ducklake catalog or a datatable database whose resource_type is
         // 'instance'. Not stored in DB to avoid drift.
@@ -1776,135 +1777,6 @@ async fn refresh_custom_instance_user_pwd(
     Ok(Json(()))
 }
 
-async fn get_external_instance_pg_status(
-    authed: ApiAuthed,
-    Extension(db): Extension<DB>,
-) -> JsonResult<windmill_common::external_instance_pg::ExternalInstancePgStatus> {
-    require_super_admin(&db, &authed).await?;
-    Ok(Json(
-        windmill_common::external_instance_pg::external_instance_pg_status(&db).await?,
-    ))
-}
-
-#[derive(Deserialize)]
-struct SetupExternalInstancePgBody {
-    #[serde(default)]
-    rotate_passwords: bool,
-}
-
-async fn setup_external_instance_pg(
-    authed: ApiAuthed,
-    Extension(db): Extension<DB>,
-    Json(body): Json<SetupExternalInstancePgBody>,
-) -> JsonResult<windmill_common::external_instance_pg::ExternalInstancePgSetupReport> {
-    require_super_admin(&db, &authed).await?;
-    let report = windmill_common::external_instance_pg::setup_external_instance_pg_unchecked(
-        &db,
-        body.rotate_passwords,
-    )
-    .await?;
-    let rotated = body.rotate_passwords.to_string();
-    let success = report.success.to_string();
-    windmill_audit::audit_oss::audit_log(
-        &db,
-        &authed,
-        "settings.setup_external_instance_pg",
-        windmill_audit::ActionKind::Update,
-        "global",
-        Some(&authed.email),
-        Some(
-            [
-                ("rotate_passwords", rotated.as_str()),
-                ("success", success.as_str()),
-            ]
-            .into(),
-        ),
-    )
-    .await?;
-    Ok(Json(report))
-}
-
-#[derive(Serialize)]
-struct ExternalInstancePgDatabase {
-    #[serde(flatten)]
-    status: windmill_common::instance_config::CustomInstanceDb,
-    used_by_workspaces: Vec<String>,
-}
-
-async fn list_external_instance_pg_databases(
-    authed: ApiAuthed,
-    Extension(db): Extension<DB>,
-) -> JsonResult<std::collections::BTreeMap<String, ExternalInstancePgDatabase>> {
-    require_super_admin(&db, &authed).await?;
-    let databases = windmill_common::external_instance_pg::external_instance_databases(&db).await?;
-    let mut usages =
-        windmill_common::external_instance_pg::external_instance_database_usages(&db).await?;
-    Ok(Json(
-        databases
-            .into_iter()
-            .map(|(name, status)| {
-                let used_by_workspaces = usages.remove(&name).unwrap_or_default();
-                (
-                    name,
-                    ExternalInstancePgDatabase {
-                        status,
-                        used_by_workspaces: used_by_workspaces.into_iter().collect(),
-                    },
-                )
-            })
-            .collect(),
-    ))
-}
-
-async fn create_external_instance_pg_database(
-    authed: ApiAuthed,
-    Extension(db): Extension<DB>,
-    Path(dbname): Path<String>,
-    Json(body): Json<SetupCustomInstanceDbBody>,
-) -> JsonResult<()> {
-    require_super_admin(&db, &authed).await?;
-    let tag = body.tag.as_deref().unwrap_or("datatable");
-    windmill_common::external_instance_pg::create_external_instance_database_unchecked(
-        &db, &dbname, tag, None,
-    )
-    .await?;
-    windmill_audit::audit_oss::audit_log(
-        &db,
-        &authed,
-        "settings.create_external_instance_pg_database",
-        windmill_audit::ActionKind::Create,
-        "global",
-        Some(&authed.email),
-        Some([("dbname", dbname.as_str()), ("tag", tag)].into()),
-    )
-    .await?;
-    Ok(Json(()))
-}
-
-async fn drop_external_instance_pg_database(
-    authed: ApiAuthed,
-    Extension(db): Extension<DB>,
-    Path(dbname): Path<String>,
-) -> JsonResult<()> {
-    require_super_admin(&db, &authed).await?;
-    // A data table naming a dropped database fails on every job, far from the drop that caused it.
-    windmill_common::external_instance_pg::drop_external_instance_database_unchecked(
-        &db, &dbname, None,
-    )
-    .await?;
-    windmill_audit::audit_oss::audit_log(
-        &db,
-        &authed,
-        "settings.drop_external_instance_pg_database",
-        windmill_audit::ActionKind::Delete,
-        "global",
-        Some(&authed.email),
-        Some([("dbname", dbname.as_str())].into()),
-    )
-    .await?;
-    Ok(Json(()))
-}
-
 #[derive(Deserialize)]
 struct SetupCustomInstanceDbBody {
     tag: Option<String>,
@@ -1919,16 +1791,15 @@ async fn setup_custom_instance_pg_database(
     // Before anything is recorded: the status written below replaces the registry entry, and with it
     // the workspace a fork copy is reserved for.
     require_super_admin(&db, &authed).await?;
-    // A re-run keeps the fork reservation: without it, the workspace the copy was made for could no
-    // longer import into it or finish its fork.
-    let workspace_id = sqlx::query_scalar::<_, Option<String>>(
-        "SELECT value->'databases'->$1->>'workspace_id' FROM global_settings
-         WHERE name = 'custom_instance_pg_databases'",
+    // Fork cleanup checks and drops the database and its entry under this lock. Held from before
+    // the setup creates the database to after its entry is written, neither lands on the other's
+    // half-done state: a dropped database with its entry written back, or the reverse.
+    let mut tx = db.begin().await?;
+    windmill_common::datatable_roles::lock_instance_databases_governance(
+        &mut tx,
+        [dbname.trim()],
     )
-    .bind(&dbname)
-    .fetch_optional(&db)
-    .await?
-    .flatten();
+    .await?;
     let mut logs = CustomInstanceDbLogs::default();
     let result = setup_custom_instance_pg_database_inner(authed, &db, &dbname, &mut logs).await;
     let success = result.is_ok();
@@ -1939,14 +1810,26 @@ async fn setup_custom_instance_pg_database(
         error,
         tag: body.tag,
         used_by_workspaces: vec![],
-        workspace_id,
+        workspace_id: None,
     };
     let status_json = serde_json::to_value(&status).map_err(to_anyhow)?;
-    // Save that the database was setup successfully
-    sqlx::query!(
-        r#"UPDATE global_settings SET value = jsonb_set(value, '{databases}', (COALESCE(value->'databases', '{}'::jsonb) || to_jsonb($1::json))) WHERE name = 'custom_instance_pg_databases'"#,
-        json!({ dbname: status_json })
-    ).execute(&db).await?;
+    // The fork reservation is carried over inside the write, from whatever the row holds then: a
+    // rename migrating it while the setup above ran would otherwise be overwritten with the value
+    // this request started from, stranding the copy under the archived workspace.
+    let saved = sqlx::query_scalar::<_, serde_json::Value>(
+        r#"UPDATE global_settings SET value = jsonb_set(value, '{databases}',
+               COALESCE(value->'databases', '{}'::jsonb)
+                   || jsonb_build_object($1::text, $2::jsonb || jsonb_build_object(
+                          'workspace_id', value->'databases'->$1::text->'workspace_id')))
+           WHERE name = 'custom_instance_pg_databases'
+           RETURNING value->'databases'->$1::text"#,
+    )
+    .bind(&dbname)
+    .bind(&status_json)
+    .fetch_one(&mut *tx)
+    .await?;
+    tx.commit().await?;
+    let status: CustomInstanceDb = serde_json::from_value(saved).map_err(to_anyhow)?;
 
     Ok(Json(status))
 }

backend/windmill-api-workspaces/src/datatable_acl.rs

@@ -6,7 +6,7 @@
  * LICENSE-AGPL for a copy of the license.
  */
 
-//! Ownership and grants on the objects of a data table on a cluster Windmill manages.
+//! Ownership and grants on the objects of an instance data table.
 //!
 //! [`datatable_permissions`](crate::datatable_permissions) decides who may connect as which role;
 //! this decides what each role may then touch. Every change is a real `GRANT`, `REVOKE`,
@@ -33,7 +33,7 @@ use windmill_audit::audit_oss::audit_log;
 use windmill_audit::ActionKind;
 use windmill_common::datatable_roles::{
     lock_role_catalog, quote_ident, read_role_catalog, read_role_catalog_tx, DatatableRoleCatalog,
-    DatatableRoleCluster, ADMIN_DATATABLE_ROLE, CUSTOM_INSTANCE_USER,
+    ADMIN_DATATABLE_ROLE, CUSTOM_INSTANCE_USER,
 };
 use windmill_common::error::{pg_error_message, Error, JsonResult, Result};
 use windmill_common::workspaces::{resolve_governing_datatable, DataTable, GoverningDatatable};
@@ -295,22 +295,22 @@ fn role_names(catalog: &DatatableRoleCatalog) -> Vec<String> {
     names
 }
 
-/// The cluster whose roles the data table's grants name.
-fn ensure_managed(governing: &GoverningDatatable) -> Result<DatatableRoleCluster> {
-    governing.role_cluster().ok_or_else(|| {
-        Error::BadRequest(format!(
-            "Data table '{}' is backed by a Postgres resource, so its access is managed on that \
-             server directly. Only a data table on a database Windmill manages has data table \
-             roles to grant to.",
-            governing.name
-        ))
-    })
+fn ensure_instance(governing: &GoverningDatatable) -> Result<()> {
+    if governing.is_instance() {
+        return Ok(());
+    }
+    Err(Error::BadRequest(format!(
+        "Data table '{}' is backed by a Postgres resource, so its access is managed on that \
+         server directly. Only a data table on the Windmill instance's own database has data \
+         table roles to grant to.",
+        governing.name
+    )))
 }
 
 /// The data table's `admin` connection, and the notices Postgres sends on it.
 ///
-/// Authorization: connects as `custom_instance_user` with the cluster's stored credentials and
-/// checks nothing. Callers MUST have authorized the request first — a request about to be refused must
+/// Authorization: connects as `custom_instance_user` with the instance's own credentials and checks
+/// nothing. Callers MUST have authorized the request first — a request about to be refused must
 /// not get as far as this connection.
 async fn connect_as_admin_unchecked(
     db: &DB,
@@ -320,33 +320,21 @@ async fn connect_as_admin_unchecked(
     mpsc::UnboundedReceiver<DbError>,
     String,
 )> {
-    let cluster = ensure_managed(governing)?;
+    ensure_instance(governing)?;
     // Built from the authorized entry, never by resolving the settings again: a save in between
     // could point the entry at a resource on another server and back, and this connection would
     // then alter a database the later checks of the entry never see.
-    let dbname = governing
+    let mut pg = PgDatabase::parse_uri(&windmill_common::get_database_url().await?.as_str().await)?;
+    pg.dbname = governing
         .datatable
         .database
         .as_ref()
         .expect("a governing entry owns a database")
         .resource_path
         .clone();
-    let pg = match cluster {
-        DatatableRoleCluster::Instance => {
-            let mut pg =
-                PgDatabase::parse_uri(&windmill_common::get_database_url().await?.as_str().await)?;
-            pg.dbname = dbname.clone();
-            pg.user = Some(CUSTOM_INSTANCE_USER.to_string());
-            pg.password = Some(windmill_common::utils::get_custom_pg_instance_password(db).await?);
-            pg
-        }
-        DatatableRoleCluster::ExternalInstance => {
-            windmill_common::external_instance_pg::external_instance_connection_unchecked(
-                db, &dbname, false,
-            )
-            .await?
-        }
-    };
+    pg.user = Some(CUSTOM_INSTANCE_USER.to_string());
+    pg.password = Some(windmill_common::utils::get_custom_pg_instance_password(db).await?);
+    let dbname = pg.dbname.clone();
     let (client, mut connection) = pg.connect(Some(db)).await?;
     // Unbounded: the driver must never wait on the receiver, which only drains once the statement
     // the driver is carrying has completed.
@@ -1032,12 +1020,12 @@ async fn get_datatable_acl(
     let target: AclTarget = query.try_into()?;
     let governing = resolve_governing_datatable(&db, &w_id, &datatable_name).await?;
     ensure_reaches_governing_datatable(&db, &w_id, &datatable_name, &governing, &authed).await?;
-    let cluster = ensure_managed(&governing)?;
+    ensure_instance(&governing)?;
     let editable = ensure_governs_datatable(&db, &authed, &w_id, &governing)
         .await
         .is_ok();
     let roles = if editable {
-        role_names(&read_role_catalog(&db, cluster).await?)
+        role_names(&read_role_catalog(&db).await?)
     } else {
         vec![]
     };
@@ -1322,7 +1310,7 @@ async fn authorize_acl_change(
 ) -> Result<GoverningDatatable> {
     let governing = resolve_governing_datatable(db, w_id, datatable_name).await?;
     ensure_governs_datatable(db, authed, w_id, &governing).await?;
-    ensure_managed(&governing)?;
+    ensure_instance(&governing)?;
     Ok(governing)
 }
 
@@ -1332,14 +1320,8 @@ static APPLY_SLOT: tokio::sync::Semaphore = tokio::sync::Semaphore::const_new(1)
 /// provisioned before data table roles gave `custom_instance_user` none. Adds that option to its
 /// database and `public` privileges, and nothing else: default privileges are left alone, since a
 /// schema's change of owner is planned against them. Best-effort, as a grant it fails to enable is
-/// refused when it runs. An external instance database was created with the options, so one
-/// missing there is someone's deliberate revoke and is left alone.
-async fn ensure_grant_options(
-    client: &tokio_postgres::Client,
-    db: &DB,
-    cluster: DatatableRoleCluster,
-    dbname: &str,
-) {
+/// refused when it runs.
+async fn ensure_grant_options(client: &tokio_postgres::Client, db: &DB, dbname: &str) {
     let held = client
         .query_one(
             "SELECT has_database_privilege(current_database(), 'CONNECT WITH GRANT OPTION')
@@ -1351,7 +1333,7 @@ async fn ensure_grant_options(
         )
         .await
         .is_ok_and(|row| row.get::<_, bool>(0));
-    if held || cluster != DatatableRoleCluster::Instance {
+    if held {
         return;
     }
     if let Err(e) = grant_options_as_server(db, dbname).await {
@@ -1577,8 +1559,7 @@ async fn plan_datatable_acl(
 ) -> JsonResult<AclPlan> {
     crate::datatable_acl_oss::ensure_datatable_acl_available()?;
     let governing = authorize_acl_change(&db, &authed, &w_id, &datatable_name).await?;
-    let cluster = ensure_managed(&governing)?;
-    let catalog = read_role_catalog(&db, cluster).await?;
+    let catalog = read_role_catalog(&db).await?;
     let (client, _notices, dbname) = connect_as_admin_unchecked(&db, &governing).await?;
     Ok(Json(
         build_plan(&client, &dbname, &catalog, &req.target, &req.change).await?,
@@ -1602,7 +1583,6 @@ async fn apply_datatable_acl(
     // connection could wait forever on a pool that concurrent applies, queued on the same locks,
     // have exhausted.
     let governing = authorize_acl_change(&db, &authed, &w_id, &datatable_name).await?;
-    let cluster = ensure_managed(&governing)?;
     // Applies queue on an instance-wide lock while each holds a direct connection to the instance's
     // Postgres; unbounded, the queue alone could exhaust its connection limit. One at a time per
     // server, and the ones waiting hold no connection at all.
@@ -1611,7 +1591,7 @@ async fn apply_datatable_acl(
         .await
         .map_err(|e| Error::internal_err(format!("ACL apply slot closed: {e}")))?;
     let (mut client, mut notices, dbname) = connect_as_admin_unchecked(&db, &governing).await?;
-    ensure_grant_options(&client, &db, cluster, &dbname).await;
+    ensure_grant_options(&client, &db, &dbname).await;
 
     // Held until the change is committed: a role renamed or dropped meanwhile would change what
     // the plan names, and a settings save could move the entry onto another database. Taken in the
@@ -1626,7 +1606,7 @@ async fn apply_datatable_acl(
     .fetch_optional(&mut *tx)
     .await?
     .flatten();
-    let catalog = read_role_catalog_tx(&mut tx, cluster).await?;
+    let catalog = read_role_catalog_tx(&mut tx).await?;
 
     let plan = build_plan(&client, &dbname, &catalog, &req.target, &req.change).await?;
     if !entry_unchanged(&governing, entry_now) || &plan.statements != confirmed {

backend/windmill-api-workspaces/src/datatable_migrations.rs

@@ -11,7 +11,7 @@
 //! to keep that file focused on core workspace configuration.
 
 use crate::workspaces::{
-    managed_datatable_kind, pg_dump_database, strip_unreplayable_dump_lines, ItemComparison,
+    is_instance_datatable, pg_dump_database, strip_unreplayable_dump_lines, ItemComparison,
     PgDumpOptions,
 };
 
@@ -1556,9 +1556,7 @@ async fn generate_initial_datatable_migration(
     // without what a replay elsewhere cannot run: the replaying user owns none of this
     // database's objects, and the grants Windmill plants in an instance database (`ALTER
     // DEFAULT PRIVILEGES FOR ROLE ...`) fail even replaying onto the same server.
-    let no_acl = managed_datatable_kind(&db, &w_id, &datatable_name)
-        .await?
-        .is_some();
+    let no_acl = is_instance_datatable(&db, &w_id, &datatable_name).await?;
     let dump_file = pg_dump_database(
         &pg_db,
         PgDumpOptions {

backend/windmill-api-workspaces/src/workspaces.rs

@@ -2263,8 +2263,7 @@ struct DataTableTables {
     schemas: TableListMap,
     #[serde(skip_serializing_if = "Option::is_none")]
     error: Option<String>,
-    /// On a database Windmill manages, on its own cluster or the external one: the only kinds that
-    /// can be under roles or have their access edited.
+    /// On the instance database: the only kind that can be under roles or have its access edited.
     instance: bool,
     permissioned: bool,
     /// The roles this caller may connect as, by name; empty when not under roles.
@@ -2521,7 +2520,7 @@ async fn list_one_datatable_tables(
     };
     let result: Result<()> = async {
         let governing = resolve_governing_datatable(db, w_id, &entry.datatable_name).await?;
-        entry.instance = governing.role_cluster().is_some();
+        entry.instance = governing.is_instance();
         let usable =
             crate::datatable_permissions_oss::usable_datatable_roles(db, authed, w_id, &governing)
                 .await?;
@@ -3079,32 +3078,23 @@ pub(crate) async fn resolve_pg_source_checked(
         .map_err(|e| Error::internal_err(format!("Failed to parse database credentials: {}", e)))
 }
 
-/// The kind of the database backing the data table `name` when Windmill manages it (on its own
-/// cluster or the external one), `None` when it is a user resource.
-pub(crate) async fn managed_datatable_kind(
-    db: &DB,
-    w_id: &str,
-    name: &str,
-) -> Result<Option<DataTableCatalogResourceType>> {
+/// Whether the data table `name` is backed by the Windmill instance's own PostgreSQL
+/// rather than a user resource.
+pub(crate) async fn is_instance_datatable(db: &DB, w_id: &str, name: &str) -> Result<bool> {
     // Resolved rather than read: a pointer entry owns no database of its own, so only the entry it
-    // lands on can answer. A name that resolves to nothing keeps the historical `None`.
+    // lands on can answer. A name that resolves to nothing keeps the historical `false`.
     Ok(resolve_governing_datatable(db, w_id, name)
         .await
         .ok()
         .and_then(|g| g.datatable.database)
-        .map(|d| d.resource_type)
-        .filter(|kind| kind.is_windmill_managed()))
+        .is_some_and(|d| d.resource_type == DataTableCatalogResourceType::Instance))
 }
 
 /// Same, for the `datatable://<name>` / `$res:<path>` form the import endpoints take.
-async fn managed_datatable_source_kind(
-    db: &DB,
-    w_id: &str,
-    source: &str,
-) -> Result<Option<DataTableCatalogResourceType>> {
+async fn is_instance_datatable_source(db: &DB, w_id: &str, source: &str) -> Result<bool> {
     match source.strip_prefix("datatable://") {
-        Some(name) => managed_datatable_kind(db, w_id, name).await,
-        None => Ok(None),
+        Some(name) => is_instance_datatable(db, w_id, name).await,
+        None => Ok(false),
     }
 }
 
@@ -3203,7 +3193,10 @@ pub(crate) async fn pg_dump_database(
     if let Some(ref password) = pg_db.password {
         cmd.env("PGPASSWORD", password);
     }
-    let _root_cert = apply_pg_tls_env(&mut cmd, pg_db)?;
+
+    if let Some(ref sslmode) = pg_db.sslmode {
+        cmd.env("PGSSLMODE", sslmode);
+    }
 
     let output = cmd
         .output()
@@ -3321,7 +3314,7 @@ async fn comment_out_unsupported_settings(
 
 /// A psql invocation against `pg_db`, carrying the connection settings the CLI reads
 /// from the environment.
-fn psql_command(pg_db: &PgDatabase) -> Result<(tokio::process::Command, Option<DumpFile>)> {
+fn psql_command(pg_db: &PgDatabase) -> tokio::process::Command {
     let mut cmd = tokio::process::Command::new("psql");
     cmd.arg("--host")
         .arg(&pg_db.host)
@@ -3338,88 +3331,10 @@ fn psql_command(pg_db: &PgDatabase) -> Result<(tokio::process::Command, Option<D
     if let Some(ref password) = pg_db.password {
         cmd.env("PGPASSWORD", password);
     }
-    let root_cert = apply_pg_tls_env(&mut cmd, pg_db)?;
-    Ok((cmd, root_cert))
-}
-
-/// Give libpq the TLS settings `PgDatabase::connect` applies. The returned file holds the root
-/// certificate `PGSSLROOTCERT` names, so it must outlive the command.
-fn apply_pg_tls_env(
-    cmd: &mut tokio::process::Command,
-    pg_db: &PgDatabase,
-) -> Result<Option<DumpFile>> {
     if let Some(ref sslmode) = pg_db.sslmode {
         cmd.env("PGSSLMODE", sslmode);
     }
-    if let Some(pem) = pg_db
-        .root_certificate_pem
-        .as_deref()
-        .filter(|p| !p.is_empty())
-    {
-        let file = DumpFile::new()?;
-        std::fs::write(&file.path, pem)
-            .map_err(|e| Error::internal_err(format!("Failed to write root certificate: {e}")))?;
-        cmd.env("PGSSLROOTCERT", &file.path);
-        return Ok(Some(file));
-    }
-    // Only a connection that asked to be verified against the system trust store. Without a file,
-    // libpq's own default would look for `~/.postgresql/root.crt` and refuse a verify-* mode. libpq
-    // takes the special `system` value with verify-full only, so verify-ca needs the bundle itself.
-    if pg_db.accept_invalid_certs == Some(false) {
-        match pg_db.sslmode.as_deref() {
-            Some("verify-full") => {
-                cmd.env("PGSSLROOTCERT", "system");
-            }
-            Some("verify-ca") => {
-                if let Some(bundle) = windmill_common::system_ca_bundle() {
-                    cmd.env("PGSSLROOTCERT", bundle);
-                }
-            }
-            _ => {}
-        }
-    }
-    Ok(None)
-}
-
-
-#[cfg(test)]
-mod pg_tls_env_tests {
-    use super::apply_pg_tls_env;
-    use windmill_common::PgDatabase;
-
-    fn root_cert_env(sslmode: &str) -> Option<std::ffi::OsString> {
-        let pg_db = PgDatabase {
-            host: "db".to_string(),
-            user: None,
-            password: None,
-            port: None,
-            sslmode: Some(sslmode.to_string()),
-            dbname: "d".to_string(),
-            root_certificate_pem: None,
-            accept_invalid_certs: Some(false),
-            use_iam_auth: None,
-            region: None,
-        };
-        let mut cmd = tokio::process::Command::new("psql");
-        apply_pg_tls_env(&mut cmd, &pg_db).unwrap();
-        cmd.as_std()
-            .get_envs()
-            .find(|(k, _)| *k == "PGSSLROOTCERT")
-            .and_then(|(_, v)| v.map(|v| v.to_os_string()))
-    }
-
-    #[test]
-    fn system_roots_only_through_verify_full() {
-        assert_eq!(
-            root_cert_env("verify-full").as_deref(),
-            Some("system".as_ref())
-        );
-        // libpq refuses `sslrootcert=system` with verify-ca, which would fail every dump and restore.
-        assert_ne!(
-            root_cert_env("verify-ca").as_deref(),
-            Some("system".as_ref())
-        );
-    }
+    cmd
 }
 
 /// GUC names the server backing `pg_db` knows about.
@@ -3429,8 +3344,7 @@ mod pg_tls_env_tests {
 /// and an unset mode, where `PgDatabase::connect` would hand a TLS-only server a
 /// plaintext socket and fail before the import ever starts.
 async fn server_setting_names(pg_db: &PgDatabase) -> Result<HashSet<String>> {
-    let (mut cmd, _root_cert) = psql_command(pg_db)?;
-    let output = cmd
+    let output = psql_command(pg_db)
         .arg("--tuples-only")
         .arg("--no-align")
         .arg("--command")
@@ -3464,8 +3378,7 @@ async fn pg_import_dump(target_db: &PgDatabase, dump_file: &DumpFile) -> Result<
     let supported_settings = server_setting_names(target_db).await?;
     comment_out_unsupported_settings(dump_file, &supported_settings).await?;
 
-    let (mut cmd, _root_cert) = psql_command(target_db)?;
-    let output = cmd
+    let output = psql_command(target_db)
         .arg("--set")
         .arg("ON_ERROR_STOP=1")
         .arg("--single-transaction")
@@ -3523,16 +3436,20 @@ async fn create_pg_database(
         }
     }
 
-    let source_kind = managed_datatable_source_kind(&db, &w_id, &req.source).await?;
-    if source_kind == Some(DataTableCatalogResourceType::ExternalInstance) {
-        windmill_common::external_instance_pg::create_external_instance_database_unchecked(
-            &db,
-            &req.target_dbname,
-            "datatable",
-            Some(&w_id),
-        )
-        .await?;
-    } else if source_kind == Some(DataTableCatalogResourceType::Instance) {
+    if is_instance_datatable_source(&db, &w_id, &req.source).await? {
+        // Held until the copy is registered, as a rename migrates reservations to the new id under
+        // it once the old one is archived: a copy registered after that would be reserved for an
+        // id nothing answers on.
+        let mut tx = db.begin().await?;
+        windmill_common::workspaces::lock_fork_datatables(&mut tx, &w_id).await?;
+        let live = sqlx::query_scalar::<_, bool>("SELECT NOT deleted FROM workspace WHERE id = $1")
+            .bind(&w_id)
+            .fetch_optional(&mut *tx)
+            .await?
+            .unwrap_or(false);
+        if !live {
+            return Err(Error::BadRequest(format!("Workspace '{w_id}' is archived")));
+        }
         windmill_common::create_custom_instance_database(
             &db,
             &req.target_dbname,
@@ -3540,6 +3457,7 @@ async fn create_pg_database(
             Some(&w_id),
         )
         .await?;
+        tx.commit().await?;
     } else {
         let source_pg =
             resolve_pg_source_checked(&db, &user_db, &authed, &w_id, &req.source).await?;
@@ -3640,12 +3558,12 @@ async fn ensure_datatable_is_clonable(
     }
     // The copy has to name a database of its own. A resource-backed entry reached through a
     // pointer names one this workspace does not own, so there is nothing here to repoint.
-    let is_managed = governing
+    let is_instance = governing
         .datatable
         .database
         .as_ref()
-        .is_some_and(|d| d.resource_type.is_windmill_managed());
-    if governing.workspace_id != w_id && !is_managed {
+        .is_some_and(|d| d.resource_type == DataTableCatalogResourceType::Instance);
+    if governing.workspace_id != w_id && !is_instance {
         return Err(Error::BadRequest(format!(
             "Data table '{name}' points at a resource-backed data table in another workspace \
              and cannot be copied; fork it from the workspace that owns it."
@@ -3681,6 +3599,7 @@ async fn import_pg_database(
     }
 
     let schema_only = req.fork_behavior == DataTableForkBehavior::SchemaOnly;
+    let mut fork_lock: Option<Transaction<'_, Postgres>> = None;
     let source_pg = resolve_pg_source_checked(&db, &user_db, &authed, &w_id, &req.source).await?;
     let mut target_pg =
         resolve_pg_source_checked(&db, &user_db, &authed, &w_id, &req.target).await?;
@@ -3693,14 +3612,20 @@ async fn import_pg_database(
                         .to_string(),
                 ));
             }
-            if let Some(kind) = managed_datatable_source_kind(&db, &w_id, &req.target).await? {
-                windmill_common::ensure_fork_database_available_to(
-                    &db,
-                    kind,
-                    override_dbname,
-                    &w_id,
+            if is_instance_datatable_source(&db, &w_id, &req.target).await? {
+                // Held until the restore is done: fork finalization takes the first, and every
+                // save newly naming a database, in any workspace, the second. Nothing may start
+                // using this database while `psql` is still filling it.
+                let mut tx = db.begin().await?;
+                windmill_common::workspaces::lock_fork_datatables(&mut tx, &w_id).await?;
+                windmill_common::datatable_roles::lock_instance_databases_governance(
+                    &mut tx,
+                    [override_dbname.as_str()],
                 )
                 .await?;
+                windmill_common::ensure_fork_database_available_to(&db, override_dbname, &w_id)
+                    .await?;
+                fork_lock = Some(tx);
             }
         }
         target_pg.dbname = override_dbname.clone();
@@ -3711,12 +3636,8 @@ async fn import_pg_database(
     // what it creates it owns. Grants do, except around an instance data table — Windmill
     // plants `custom_instance_user` grants in one, which nothing else can replay. Elsewhere
     // the ACLs are user intent (`REVOKE ... FROM PUBLIC`) and dropping them widens access.
-    let no_acl = managed_datatable_source_kind(&db, &w_id, &req.target)
-        .await?
-        .is_some()
-        || managed_datatable_source_kind(&db, &w_id, &req.source)
-            .await?
-            .is_some();
+    let no_acl = is_instance_datatable_source(&db, &w_id, &req.target).await?
+        || is_instance_datatable_source(&db, &w_id, &req.source).await?;
 
     let dump_file = pg_dump_database(
         &source_pg,
@@ -3724,6 +3645,9 @@ async fn import_pg_database(
     )
     .await?;
     pg_import_dump(&target_pg, &dump_file).await?;
+    if let Some(tx) = fork_lock {
+        tx.commit().await?;
+    }
 
     Ok(format!(
         "Imported from '{}' into '{}'",
@@ -3815,51 +3739,54 @@ async fn edit_ducklake_config(
     )
     .await?;
 
-    let old_ducklakes = sqlx::query_scalar!(
-        r#"
-            SELECT ws.ducklake->'ducklakes' AS ducklake_name
-            FROM workspace_settings ws
-            WHERE ws.workspace_id = $1
-        "#,
-        &w_id
+    // Under the row lock the save writes with, taken before the database locks below as fork
+    // cleanup takes the two.
+    let old_ducklakes = sqlx::query_scalar::<_, Option<serde_json::Value>>(
+        "SELECT ws.ducklake->'ducklakes' FROM workspace_settings ws
+         WHERE ws.workspace_id = $1 FOR UPDATE",
     )
+    .bind(&w_id)
     .fetch_one(&mut *tx)
     .await?
     .unwrap_or(serde_json::Value::Null);
     let old_ducklakes: HashMap<String, Ducklake> =
         serde_json::from_value(old_ducklakes).unwrap_or_default();
 
-    // Check that non-superadmins are not abusing Instance databases. An unchanged catalog is left
-    // alone either way, so a downgraded instance can still save lakes that already name an
-    // external instance database.
-    for (name, dl) in new_config.settings.ducklakes.iter() {
-        let kind = &dl.catalog.resource_type;
-        if !matches!(
-            kind,
-            DucklakeCatalogResourceType::Instance | DucklakeCatalogResourceType::ExternalInstance
-        ) {
-            continue;
-        }
-        let unchanged = old_ducklakes.get(name).is_some_and(|old| {
-            &old.catalog.resource_type == kind
-                && old.catalog.resource_path == dl.catalog.resource_path
-        });
-        if unchanged {
-            continue;
-        }
-        if *kind == DucklakeCatalogResourceType::ExternalInstance {
-            windmill_common::external_instance_pg::ensure_external_instance_available()?;
-            windmill_common::external_instance_pg::ensure_external_instance_database_registered(
-                &mut tx,
-                &dl.catalog.resource_path,
-            )
-            .await?;
-        }
-        if !is_superadmin {
-            return Err(Error::BadRequest(
-                "Only superadmins can create or modify ducklakes with Instance databases"
-                    .to_string(),
-            ));
+    // Fork cleanup decides nothing uses an instance database under this lock, so a catalog newly
+    // put on one must not commit between its check and its drop.
+    windmill_common::datatable_roles::lock_instance_databases_governance(
+        &mut *tx,
+        new_config
+            .settings
+            .ducklakes
+            .iter()
+            .filter(|(name, dl)| {
+                dl.catalog.resource_type == DucklakeCatalogResourceType::Instance
+                    && old_ducklakes.get(name.as_str()).is_none_or(|old| {
+                        old.catalog.resource_type != DucklakeCatalogResourceType::Instance
+                            || old.catalog.resource_path != dl.catalog.resource_path
+                    })
+            })
+            .map(|(_, dl)| dl.catalog.resource_path.as_str()),
+    )
+    .await?;
+
+    // Check that non-superadmins are not abusing Instance databases
+    if !is_superadmin {
+        for (name, dl) in new_config.settings.ducklakes.iter() {
+            if dl.catalog.resource_type == DucklakeCatalogResourceType::Instance {
+                let old_dl = old_ducklakes.get(name);
+                if old_dl.is_none()
+                    || old_dl.unwrap().catalog.resource_type
+                        != DucklakeCatalogResourceType::Instance
+                    || old_dl.unwrap().catalog.resource_path != dl.catalog.resource_path
+                {
+                    return Err(Error::BadRequest(
+                        "Only superadmins can create or modify ducklakes with Instance databases"
+                            .to_string(),
+                    ));
+                }
+            }
         }
     }
 
@@ -3918,6 +3845,8 @@ async fn edit_datatable_config(
     let is_superadmin = require_super_admin(&db, &authed).await.is_ok();
 
     let mut tx = db.begin().await?;
+    // Ahead of the settings row, as fork cleanup of this workspace takes the two.
+    windmill_common::workspaces::lock_fork_datatables(&mut tx, &w_id).await?;
 
     // Read under the row lock this transaction will write with. `permissions`, `reference` and
     // `forked_from` are carried across from what this read returns, so a permissions save
@@ -4031,7 +3960,6 @@ async fn edit_datatable_config(
                 // so these line up with the `datatable_configured` adoption counts.
                 created_substrates.push(match dt.database.as_ref().map(|d| d.resource_type) {
                     Some(DataTableCatalogResourceType::Instance) => "instance",
-                    Some(DataTableCatalogResourceType::ExternalInstance) => "external_instance",
                     Some(DataTableCatalogResourceType::Postgresql) => "postgresql",
                     None => "reference",
                 });
@@ -4051,20 +3979,18 @@ async fn edit_datatable_config(
             None => None,
         };
         // Carrying the block onto a resource-backed entry would produce a data table the chokepoint
-        // refuses on every job — a save that succeeds and breaks everything afterwards — and onto
-        // the other managed cluster, one whose role ids name nothing in that cluster's catalog.
-        // Refuse it instead: turning roles off first is one step, and it keeps discarding an access
-        // decision something somebody chose rather than a side effect of moving a database.
-        let old_kind = old.and_then(|old| old.database.as_ref()).map(|d| d.resource_type);
+        // refuses on every job — a save that succeeds and breaks everything afterwards. Refuse it
+        // instead: turning roles off first is one step, and it keeps discarding an access decision
+        // something somebody chose rather than a side effect of moving a database.
         if dt.permissions.is_some()
             && dt
                 .database
                 .as_ref()
-                .is_some_and(|d| Some(d.resource_type) != old_kind)
+                .is_some_and(|d| d.resource_type != DataTableCatalogResourceType::Instance)
         {
             return Err(Error::BadRequest(format!(
-                "Data table '{name}' is under roles, which belong to the cluster its database is \
-                 on. Turn its roles off before moving it to another kind of database."
+                "Data table '{name}' is under roles, which only a data table on the instance \
+                 database can be. Turn its roles off before moving it to a PostgreSQL resource."
             )));
         }
         // A pointer names no database of its own, so the form's empty `database` is correct there.
@@ -4089,39 +4015,26 @@ async fn edit_datatable_config(
     // Check that non-superadmins are not abusing Instance databases, which reach a database this
     // workspace does not own. Pointing an entry at another workspace's data table is not checked
     // here because it cannot be requested at all: `reference` is overwritten from the stored entry
-    // above, for every caller. An unchanged entry is left alone either way, so a downgraded
-    // instance can still save settings that already name an external instance database.
-    for (name, dt) in new_config.settings.datatables.iter() {
-        let Some(database) = dt
-            .database
-            .as_ref()
-            .filter(|d| d.resource_type.is_windmill_managed())
-        else {
-            continue;
-        };
-        let unchanged = old_datatables
-            .get(name)
-            .and_then(|o| o.database.as_ref())
-            .is_some_and(|o| {
-                o.resource_type == database.resource_type
-                    && o.resource_path == database.resource_path
-            });
-        if unchanged {
-            continue;
-        }
-        if database.resource_type == DataTableCatalogResourceType::ExternalInstance {
-            windmill_common::external_instance_pg::ensure_external_instance_available()?;
-            windmill_common::external_instance_pg::ensure_external_instance_database_registered(
-                &mut tx,
-                &database.resource_path,
-            )
-            .await?;
-        }
-        if !is_superadmin {
-            return Err(Error::BadRequest(
-                "Only superadmins can create or modify data tables with Instance databases"
-                    .to_string(),
-            ));
+    // above, for every caller.
+    if !is_superadmin {
+        for (name, dt) in new_config.settings.datatables.iter() {
+            let old_dt = old_datatables.get(name);
+            if dt
+                .database
+                .as_ref()
+                .is_some_and(|d| d.resource_type == DataTableCatalogResourceType::Instance)
+            {
+                let unchanged = old_dt.and_then(|o| o.database.as_ref()).is_some_and(|o| {
+                    o.resource_type == DataTableCatalogResourceType::Instance
+                        && Some(&o.resource_path) == dt.database.as_ref().map(|d| &d.resource_path)
+                });
+                if !unchanged {
+                    return Err(Error::BadRequest(
+                        "Only superadmins can create or modify data tables with Instance databases"
+                            .to_string(),
+                    ));
+                }
+            }
         }
     }
 
@@ -4141,7 +4054,7 @@ async fn edit_datatable_config(
     // entry through a declared rename alone, and a settings sync never declares one, so an entry
     // without roles that newly points at such a database — a name added, or an existing one
     // repointed — would answer everyone there as `admin`. That holds whichever workspace governs it.
-    let newly_pointed: Vec<(&String, DataTableCatalogResourceType, &str)> = new_config
+    let newly_pointed: Vec<(&String, &str)> = new_config
         .settings
         .datatables
         .iter()
@@ -4150,7 +4063,7 @@ async fn edit_datatable_config(
             let db = dt
                 .database
                 .as_ref()
-                .filter(|d| d.resource_type.is_windmill_managed())?;
+                .filter(|d| d.resource_type == DataTableCatalogResourceType::Instance)?;
             let lookup = rename_src
                 .get(name.as_str())
                 .copied()
@@ -4162,44 +4075,66 @@ async fn edit_datatable_config(
                     old_db.resource_type != db.resource_type
                         || old_db.resource_path != db.resource_path
                 });
-            repointed.then_some((name, db.resource_type, db.resource_path.as_str()))
+            repointed.then_some((name, db.resource_path.as_str()))
         })
         .collect();
     // Another workspace turning roles on for the same database holds only its own settings row, so
-    // without this the scan below could read past its uncommitted write.
+    // without this the scan below could read past its uncommitted write. Every managed database
+    // this save newly names is locked, not just the ones the scan is about: fork cleanup takes the
+    // same lock to decide nothing uses the database it is dropping.
+    let newly_named: std::collections::BTreeSet<&str> = new_config
+        .settings
+        .datatables
+        .iter()
+        .filter_map(|(name, dt)| {
+            let db = dt
+                .database
+                .as_ref()
+                .filter(|d| d.resource_type == DataTableCatalogResourceType::Instance)?;
+            let lookup = rename_src
+                .get(name.as_str())
+                .copied()
+                .unwrap_or(name.as_str());
+            old_datatables
+                .get(lookup)
+                .and_then(|old| old.database.as_ref())
+                .is_none_or(|old_db| {
+                    old_db.resource_type != db.resource_type
+                        || old_db.resource_path != db.resource_path
+                })
+                .then_some(db.resource_path.as_str())
+        })
+        .collect();
     windmill_common::datatable_roles::lock_instance_databases_governance(
         &mut *tx,
-        newly_pointed.iter().map(|(_, _, dbname)| *dbname),
+        newly_pointed
+            .iter()
+            .map(|(_, dbname)| *dbname)
+            .chain(newly_named.iter().copied()),
     )
     .await?;
-    let governed_elsewhere: Vec<(String, String)> = if newly_pointed.is_empty() {
+    let governed_elsewhere: Vec<String> = if newly_pointed.is_empty() {
         vec![]
     } else {
-        sqlx::query_as(
-            "SELECT DISTINCT dt.value->'database'->>'resource_type',
-                    dt.value->'database'->>'resource_path'
-             FROM workspace_settings ws
+        sqlx::query_scalar(
+            "SELECT DISTINCT dt.value->'database'->>'resource_path' FROM workspace_settings ws
              CROSS JOIN LATERAL jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) dt
              WHERE ws.workspace_id <> $1 AND dt.value ? 'permissions'
-               AND dt.value->'database'->>'resource_type' IN ('instance', 'external_instance')",
+               AND dt.value->'database'->>'resource_type' = 'instance'",
         )
         .bind(&w_id)
         .fetch_all(&mut *tx)
         .await?
     };
-    for (name, kind, dbname) in newly_pointed {
+    for (name, dbname) in newly_pointed {
         let governed_here = old_datatables.values().any(|old| {
             old.permissions.is_some()
-                && old
-                    .database
-                    .as_ref()
-                    .is_some_and(|d| d.resource_type == kind && d.resource_path == dbname)
+                && old.database.as_ref().is_some_and(|d| {
+                    d.resource_type == DataTableCatalogResourceType::Instance
+                        && d.resource_path == dbname
+                })
         });
-        if governed_here
-            || governed_elsewhere
-                .iter()
-                .any(|(k, p)| k == kind.as_ref() && p == dbname)
-        {
+        if governed_here || governed_elsewhere.iter().any(|g| g == dbname) {
             return Err(Error::BadRequest(format!(
                 "Data table '{name}' would point at database '{dbname}', which a data table under \
                  roles uses, without carrying those roles: everyone reaching '{name}' would connect \
@@ -8213,14 +8148,13 @@ async fn point_kept_datatables_at_parent(
         if dt.reference.is_some() {
             continue;
         }
-        // Only instance databases, on either cluster. A resource-backed data table names a
-        // resource, and the settings clone gave the fork its own copy of that resource in its own
-        // workspace — pointing at the parent's entry would silently move the fork onto the
-        // parent's resource instead.
+        // Only instance databases. A resource-backed data table names a resource, and the settings
+        // clone gave the fork its own copy of that resource in its own workspace — pointing at the
+        // parent's entry would silently move the fork onto the parent's resource instead.
         if dt
             .database
             .as_ref()
-            .is_none_or(|d| !d.resource_type.is_windmill_managed())
+            .is_none_or(|d| d.resource_type != DataTableCatalogResourceType::Instance)
         {
             continue;
         }
@@ -8350,30 +8284,26 @@ async fn apply_forked_datatable(
         })?,
     };
 
-    if database.resource_type == DataTableCatalogResourceType::ExternalInstance {
-        windmill_common::external_instance_pg::ensure_external_instance_database_registered(
-            tx,
-            &fdt.new_dbname,
+    if database.resource_type == DataTableCatalogResourceType::Instance {
+        // Held until the fork commits, as every save newly naming a database takes it: none may
+        // claim the copy between the check below and this fork's entry landing on it.
+        windmill_common::datatable_roles::lock_instance_databases_governance(
+            &mut **tx,
+            [fdt.new_dbname.as_str()],
         )
         .await?;
     }
-    if database.resource_type.is_windmill_managed()
+    if database.resource_type == DataTableCatalogResourceType::Instance
         && !windmill_api_auth::is_super_admin_authed(db, authed).await?
     {
-        windmill_common::ensure_fork_database_available_to(
-            db,
-            database.resource_type,
-            &fdt.new_dbname,
-            parent_w_id,
-        )
-        .await?;
+        windmill_common::ensure_fork_database_available_to(db, &fdt.new_dbname, parent_w_id)
+            .await?;
     }
-    if database.resource_type.is_windmill_managed() {
+    if database.resource_type == DataTableCatalogResourceType::Instance {
         // The whole `database` object, not just its `resource_path`: a pointer entry has none to
-        // patch. `reference` goes with it — exactly one of the two may be set. The copy was created
-        // on the same cluster as its source, so it keeps the source's kind.
+        // patch. `reference` goes with it — exactly one of the two may be set.
         let new_database = serde_json::json!({
-            "resource_type": database.resource_type,
+            "resource_type": "instance",
             "resource_path": &fdt.new_dbname,
         });
         sqlx::query!(
@@ -8764,8 +8694,6 @@ async fn create_workspace_fork(
     let mut tx: Transaction<'_, Postgres> = db.begin().await?;
     // Before the settings clone reads the parent's data tables: a pointer this fork ends up with
     // must not be written after cleanup of the parent decided that nothing points at its copies.
-    // Also before the external cluster's lifecycle lock, which finalizing an external copy takes:
-    // fork cleanup takes the two in this order.
     windmill_common::workspaces::lock_fork_datatables(&mut tx, &parent_workspace_id).await?;
 
     if nw.is_dev_workspace {

backend/windmill-api-workspaces/src/workspaces_extra.rs

@@ -56,6 +56,11 @@ pub(crate) async fn change_workspace_id(
 
     let mut tx = db.begin().await?;
 
+    // The settings copy below carries every data table entry to the new id, which fork cleanup of
+    // the old id cannot see until this commits: without the lock it could drop a copy the renamed
+    // workspace goes on using. Before the pairing lock, as forking takes the two in that order.
+    windmill_common::workspaces::lock_fork_datatables(&mut tx, &old_id).await?;
+
     // A rename rewrites the workspace's dev flag and reparents its children, so it decides on the
     // same state the pairing handlers do: without this lock a concurrent create/attach could commit
     // an active dev workspace under the shell this rename is about to archive. Both ids, since the
@@ -110,21 +115,6 @@ pub(crate) async fn change_workspace_id(
     .execute(&mut *tx)
     .await?;
 
-    // A fork copy reserved for the old id would otherwise be unreachable: its creator cannot
-    // import into it or finish its fork under the new id, and nothing else would ever drop it.
-    sqlx::query(
-        r#"UPDATE global_settings SET value = jsonb_set(value, '{databases}', (
-               SELECT COALESCE(jsonb_object_agg(k, CASE WHEN v->>'workspace_id' = $1
-                   THEN jsonb_set(v, '{workspace_id}', to_jsonb($2::text)) ELSE v END), '{}'::jsonb)
-               FROM jsonb_each(COALESCE(value->'databases', '{}'::jsonb)) AS e(k, v)
-           ))
-           WHERE name = 'custom_instance_pg_databases'"#,
-    )
-    .bind(&old_id)
-    .bind(&rw.new_id)
-    .execute(&mut *tx)
-    .await?;
-
     // Duplicate workspace settings (keep copy in old workspace for reference)
     info!("Duplicating workspace_settings table");
     sqlx::query!(
@@ -865,6 +855,10 @@ pub(crate) async fn change_workspace_id(
         }
     }
 
+    // After every workspace_settings write above: fork cleanup locks a settings row before the
+    // registry, so taking the registry first here would deadlock with it.
+    migrate_fork_reservations(&mut tx, &old_id, &rw.new_id).await?;
+
     // Audit log in the same transaction as the workspace changes
     audit_log(
         &mut *tx,
@@ -933,6 +927,14 @@ pub(crate) async fn change_workspace_id(
     let (_schedules_count, canceled_count, _deleted_tokens_count) =
         archive_workspace_impl(&db, &old_id, &authed.username, None).await?;
 
+    // The old id stays live between the commit above and the archive, and a fork copy created for
+    // it in that window registers under it. Creation checks the workspace is live under the fork
+    // lock, so once this has run under it, no copy can be reserved for the old id any more.
+    let mut tx = db.begin().await?;
+    windmill_common::workspaces::lock_fork_datatables(&mut tx, &old_id).await?;
+    migrate_fork_reservations(&mut tx, &old_id, &rw.new_id).await?;
+    tx.commit().await?;
+
     info!(
         "Workspace id change completed: moved {} to {}, archived old workspace",
         old_id, rw.new_id
@@ -944,6 +946,28 @@ pub(crate) async fn change_workspace_id(
     ))
 }
 
+/// A fork copy reserved for the old id would otherwise be unreachable: its creator cannot import
+/// into it or finish its fork under the new id, and nothing else would ever drop it.
+async fn migrate_fork_reservations(
+    tx: &mut Transaction<'_, Postgres>,
+    old_id: &str,
+    new_id: &str,
+) -> Result<()> {
+    sqlx::query(
+        r#"UPDATE global_settings SET value = jsonb_set(value, '{databases}', (
+               SELECT COALESCE(jsonb_object_agg(k, CASE WHEN v->>'workspace_id' = $1
+                   THEN jsonb_set(v, '{workspace_id}', to_jsonb($2::text)) ELSE v END), '{}'::jsonb)
+               FROM jsonb_each(COALESCE(value->'databases', '{}'::jsonb)) AS e(k, v)
+           ))
+           WHERE name = 'custom_instance_pg_databases'"#,
+    )
+    .bind(old_id)
+    .bind(new_id)
+    .execute(&mut **tx)
+    .await?;
+    Ok(())
+}
+
 #[derive(Deserialize)]
 pub(crate) struct DeleteWorkspaceQuery {
     pub(crate) only_delete_forks: Option<bool>,
@@ -1424,7 +1448,9 @@ pub async fn drop_forked_datatable_databases(
             _ => continue,
         };
 
-        if database.resource_type.is_windmill_managed() {
+        if database.resource_type
+            == windmill_common::workspaces::DataTableCatalogResourceType::Instance
+        {
             let db_to_drop = &database.resource_path;
             if !db_to_drop.starts_with("wm_fork_") {
                 errors.push(format!(
@@ -1436,24 +1462,54 @@ pub async fn drop_forked_datatable_databases(
             // The fork's own entry is what is going away; anything else still reaching the copy,
             // a child fork's pointer at this entry included, keeps it. The lock keeps a child fork
             // from gaining such a pointer before the drop.
-            let dropped = async {
-                let mut tx = db.begin().await?;
-                windmill_common::workspaces::lock_fork_datatables(&mut tx, &w_id).await?;
-                if database.resource_type
-                    == windmill_common::workspaces::DataTableCatalogResourceType::ExternalInstance
-                {
-                    windmill_common::external_instance_pg::drop_external_instance_database_unchecked(
-                        &db,
-                        db_to_drop,
-                        Some((&w_id, dt_name)),
+            // A task of its own, so a client going away cannot stop it between dropping the
+            // database and committing the entry's removal.
+            let dropped = tokio::spawn({
+                let (db, w_id, dt_name, db_to_drop) = (
+                    db.clone(),
+                    w_id.clone(),
+                    dt_name.clone(),
+                    db_to_drop.clone(),
+                );
+                let resource_type = database.resource_type;
+                async move {
+                    let mut tx = db.begin().await?;
+                    // The three locks a settings save takes, in its order: this workspace's data
+                    // tables, its settings row, and the database itself. Without them a save could
+                    // rename this entry, or point another one here, either side of the check below.
+                    windmill_common::workspaces::lock_fork_datatables(&mut tx, &w_id).await?;
+                    // The snapshot above was read unlocked: a save committing since could have
+                    // repointed this entry, and the entry is removed below whatever it names by then.
+                    let current = sqlx::query_scalar::<_, Option<serde_json::Value>>(
+                        "SELECT datatable->'datatables'->$2 FROM workspace_settings
+                     WHERE workspace_id = $1 FOR UPDATE",
+                    )
+                    .bind(&w_id)
+                    .bind(&dt_name)
+                    .fetch_optional(&mut *tx)
+                    .await?
+                    .flatten()
+                    .and_then(|v| serde_json::from_value::<DataTable>(v).ok());
+                    if !current.is_some_and(|dt| {
+                        dt.forked_from.is_some()
+                            && dt.database.is_some_and(|d| {
+                                d.resource_type == resource_type && d.resource_path == db_to_drop
+                            })
+                    }) {
+                        return Err(Error::BadRequest(
+                            "the data table changed while it was being cleaned up".to_string(),
+                        ));
+                    }
+                    windmill_common::datatable_roles::lock_instance_databases_governance(
+                        &mut tx,
+                        [db_to_drop.as_str()],
                     )
                     .await?;
-                } else {
                     let uses = windmill_common::workspaces::managed_database_uses(
                         &mut tx,
                         windmill_common::workspaces::DataTableCatalogResourceType::Instance,
-                        db_to_drop,
-                        Some((&w_id, dt_name)),
+                        &db_to_drop,
+                        Some((w_id.as_str(), dt_name.as_str())),
                     )
                     .await?;
                     if !uses.is_empty() {
@@ -1462,12 +1518,31 @@ pub async fn drop_forked_datatable_databases(
                             uses.join(", ")
                         )));
                     }
-                    windmill_common::drop_custom_instance_database(&db, db_to_drop).await?;
+                    // The entry goes with the database: a fork this one is cloned into afterwards must
+                    // not inherit a pointer at a data table whose database is gone.
+                    sqlx::query(
+                    "UPDATE workspace_settings SET datatable = datatable #- ARRAY['datatables', $2]
+                     WHERE workspace_id = $1",
+                )
+                .bind(&w_id)
+                .bind(&dt_name)
+                .execute(&mut *tx)
+                .await?;
+                    windmill_common::drop_custom_instance_database_keep_entry(&db, &db_to_drop)
+                        .await?;
+                    sqlx::query(
+                        "UPDATE global_settings SET value = value #- ARRAY['databases', $1]
+                     WHERE name = 'custom_instance_pg_databases'",
+                    )
+                    .bind(&db_to_drop)
+                    .execute(&mut *tx)
+                    .await?;
+                    tx.commit().await?;
+                    Ok::<_, Error>(())
                 }
-                tx.commit().await?;
-                Ok::<_, Error>(())
-            }
-            .await;
+            })
+            .await
+            .unwrap_or_else(|e| Err(Error::internal_err(format!("cleanup task failed: {e}"))));
             if let Err(e) = dropped {
                 errors.push(format!(
                     "Could not drop instance database '{}' for datatable://{}: {}",
@@ -1835,17 +1910,7 @@ async fn resolve_fork_catalog_pg(
             "ducklake://{ducklake_name}: malformed registry catalog identity `{catalog}`"
         ))
     })?;
-    let catalog_resource = if resource_type == "external_instance" {
-        serde_json::to_value(
-            windmill_common::external_instance_pg::external_instance_connection_unchecked(
-                db,
-                resource_path,
-                false,
-            )
-            .await?,
-        )
-        .map_err(|e| Error::internal_err(format!("serializing pg creds: {e}")))?
-    } else if resource_type == "instance" {
+    let catalog_resource = if resource_type == "instance" {
         let mut pg_creds = windmill_common::PgDatabase::parse_uri(
             &windmill_common::get_database_url().await?.as_str().await,
         )?;

backend/windmill-api/openapi.yaml

@@ -1572,104 +1572,6 @@ paths:
               schema:
                 type: object
 
-  /settings/external_instance_pg/status:
-    get:
-      summary: Returns whether the external instance cluster is configured and how its last setup went
-      operationId: getExternalInstancePgStatus
-      tags:
-        - setting
-      responses:
-        "200":
-          description: external instance cluster status
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/ExternalInstancePgStatus"
-
-  /settings/external_instance_pg/setup:
-    post:
-      summary: Sets up the external instance cluster with its saved admin login, optionally rotating the passwords Windmill manages on it (enterprise edition only)
-      operationId: setupExternalInstancePg
-      tags:
-        - setting
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                rotate_passwords:
-                  type: boolean
-      responses:
-        "200":
-          description: the setup report, also stored as the last setup
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/ExternalInstancePgSetupReport"
-
-  /settings/external_instance_pg/databases:
-    get:
-      summary: Lists the databases Windmill created on the external instance cluster, with the workspaces whose data tables, Ducklake catalogs or pending fork cleanups use each
-      operationId: listExternalInstancePgDatabases
-      tags:
-        - setting
-      responses:
-        "200":
-          description: databases by name
-          content:
-            application/json:
-              schema:
-                type: object
-                additionalProperties:
-                  $ref: "#/components/schemas/CustomInstanceDb"
-
-  /settings/external_instance_pg/databases/{name}:
-    post:
-      summary: Creates a database on the external instance cluster (enterprise edition only)
-      operationId: createExternalInstancePgDatabase
-      tags:
-        - setting
-      parameters:
-        - name: name
-          in: path
-          required: true
-          schema:
-            type: string
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                tag:
-                  $ref: "#/components/schemas/CustomInstanceDbTag"
-      responses:
-        "200":
-          description: database created
-          content:
-            application/json:
-              schema: {}
-    delete:
-      summary: Drops a database Windmill created on the external instance cluster, refused while a data table, Ducklake catalog or pending fork cleanup uses it
-      operationId: dropExternalInstancePgDatabase
-      tags:
-        - setting
-      parameters:
-        - name: name
-          in: path
-          required: true
-          schema:
-            type: string
-      responses:
-        "200":
-          description: database dropped
-          content:
-            application/json:
-              schema: {}
-
   /settings/list_custom_instance_pg_databases:
     post:
       summary: Returns the set-up statuses of custom instance pg databases
@@ -1688,19 +1590,13 @@ paths:
 
   /settings/datatable_roles:
     get:
-      summary: list the data table roles of one Windmill-managed Postgres cluster
+      summary: list the instance's data table roles
       operationId: listInstanceDatatableRoles
       tags:
         - setting
-      parameters:
-        - in: query
-          name: cluster
-          required: false
-          schema:
-            $ref: "#/components/schemas/DatatableRoleCluster"
       responses:
         "200":
-          description: the cluster's role catalog
+          description: the instance role catalog
           content:
             application/json:
               schema:
@@ -1708,7 +1604,7 @@ paths:
                 items:
                   $ref: "#/components/schemas/InstanceDatatableRole"
     post:
-      summary: create a data table role on a Windmill-managed Postgres cluster
+      summary: create a data table role on the instance's Postgres cluster
       operationId: createInstanceDatatableRole
       tags:
         - setting
@@ -1722,8 +1618,6 @@ paths:
               properties:
                 name:
                   type: string
-                cluster:
-                  $ref: "#/components/schemas/DatatableRoleCluster"
       responses:
         "200":
           description: the created role
@@ -5336,7 +5230,7 @@ paths:
                       type: string
                     resource_type:
                       type: string
-                      enum: [postgres, instance, external_instance]
+                      enum: [postgres, instance]
                     resource_path:
                       type: string
                     governing_workspace_id:
@@ -33727,55 +33621,9 @@ components:
         - ducklake
         - datatable
 
-    ExternalInstancePgSetupStep:
-      type: object
-      required: [name, status, message]
-      properties:
-        name:
-          type: string
-        status:
-          type: string
-          enum: [ok, warning, error]
-        message:
-          type: string
-
-    ExternalInstancePgSetupReport:
-      type: object
-      required: [success, finished_at, steps]
-      properties:
-        success:
-          type: boolean
-          description: no step failed; warnings leave it true
-        finished_at:
-          type: string
-          format: date-time
-        steps:
-          type: array
-          items:
-            $ref: "#/components/schemas/ExternalInstancePgSetupStep"
-
-    ExternalInstancePgStatus:
-      type: object
-      required: [configured, database_count]
-      properties:
-        configured:
-          type: boolean
-        database_count:
-          type: integer
-        last_setup:
-          $ref: "#/components/schemas/ExternalInstancePgSetupReport"
-
-    DatatableRoleCluster:
-      type: string
-      description: >-
-        The Windmill-managed Postgres cluster a data table role is a login on: Windmill's own
-        (behind `instance` data tables) or the external instance cluster (behind
-        `external_instance` ones). Defaults to `instance`.
-      enum: [instance, external_instance]
-
     InstanceDatatableRole:
       type: object
-      required: [id, name, enabled, cluster]
+      required: [id, name, enabled]
       properties:
         id:
           type: string
@@ -33783,8 +33631,6 @@ components:
           type: string
         enabled:
           type: boolean
-        cluster:
-          $ref: "#/components/schemas/DatatableRoleCluster"
 
     DatatableRoleTenants:
       type: object
@@ -33806,10 +33652,8 @@ components:
         supported:
           type: boolean
           description: >-
-            Whether this data table can be put under roles at all. Only one on a database Windmill
-            manages can: a role is a login on that database's cluster.
-        cluster:
-          $ref: "#/components/schemas/DatatableRoleCluster"
+            Whether this data table can be put under roles at all. Only one backed by the
+            instance database can: a role is a login on that cluster.
         permissioned:
           type: boolean
         default_role:
@@ -36086,7 +35930,6 @@ components:
                       - postgresql
                       - mysql
                       - instance
-                      - external_instance
                   resource_path:
                     type: string
                 required:
@@ -36150,7 +35993,6 @@ components:
                     enum:
                       - postgresql
                       - instance
-                      - external_instance
                   resource_path:
                     type: string
                 required:

backend/windmill-common/Cargo.toml

@@ -75,7 +75,6 @@ bitflags.workspace = true
 once_cell.workspace = true
 phf.workspace = true
 tokio-postgres.workspace = true
-postgres-protocol.workspace = true
 postgres-native-tls.workspace = true
 native-tls.workspace = true
 

backend/windmill-common/src/datatable_roles.rs

@@ -6,67 +6,22 @@
  * LICENSE-AGPL for a copy of the license.
  */
 
-//! The instance's data table role catalogs.
+//! The instance's data table role catalog.
 //!
-//! A data table role is a real Postgres login role on one cluster — Windmill's own, or the external
-//! instance cluster — named exactly as the user named it, shared by every database Windmill manages
-//! on that cluster. Each cluster has its own catalog: a role exists where it was created and nowhere
-//! else. Windmill decides who may ask for a role (the per-data-table tenant lists in
-//! [`crate::workspaces`]); Postgres decides what the role may then touch. The catalog here is only
-//! the first half's vocabulary plus the cluster provisioning.
+//! A data table role is a real Postgres login role on the Windmill cluster, named exactly as the
+//! user named it, shared by every instance database. Windmill decides who may ask for a role (the
+//! per-data-table tenant lists in [`crate::workspaces`]); Postgres decides what the role may then
+//! touch. The catalog here is only the first half's vocabulary plus the cluster provisioning.
 //!
 //! Entries are keyed by a generated id so a rename moves nothing else: tenants name the id.
 
 use std::collections::BTreeMap;
 
-use serde::{Deserialize, Serialize};
-
 use crate::{
     error::{Error, Result},
-    workspaces::DataTableCatalogResourceType,
     DB,
 };
 
-/// The cluster a role catalog belongs to.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum DatatableRoleCluster {
-    /// Windmill's own Postgres, behind `instance` data tables.
-    #[default]
-    Instance,
-    /// The external instance cluster, behind `external_instance` data tables.
-    ExternalInstance,
-}
-
-impl DatatableRoleCluster {
-    pub fn as_str(self) -> &'static str {
-        match self {
-            Self::Instance => "instance",
-            Self::ExternalInstance => "external_instance",
-        }
-    }
-
-    pub fn parse(value: &str) -> Result<Self> {
-        match value {
-            "instance" => Ok(Self::Instance),
-            "external_instance" => Ok(Self::ExternalInstance),
-            other => Err(Error::BadRequest(format!(
-                "Unknown data table role cluster '{other}': expected instance or external_instance"
-            ))),
-        }
-    }
-
-    /// The cluster whose roles a data table on `kind` can use. `None` for a resource-backed one,
-    /// which is never under roles.
-    pub fn of(kind: DataTableCatalogResourceType) -> Option<Self> {
-        match kind {
-            DataTableCatalogResourceType::Instance => Some(Self::Instance),
-            DataTableCatalogResourceType::ExternalInstance => Some(Self::ExternalInstance),
-            DataTableCatalogResourceType::Postgresql => None,
-        }
-    }
-}
-
 /// The connection every data table resolved to before roles existed (`custom_instance_user`). It
 /// owns every pre-existing object, so it is a reserved name rather than a catalog entry: never
 /// created, renamed or dropped.
@@ -209,42 +164,28 @@ pub async fn lock_instance_databases_governance<'a>(
 /// need the names — but callers MUST NOT let `pwd` reach a response, a log line, an audit record
 /// or an export. Nothing about who may call it: the credential is the whole risk, and `Debug` is
 /// hand-written to redact it for the same reason.
-pub async fn read_role_catalog(
-    db: &DB,
-    cluster: DatatableRoleCluster,
-) -> Result<DatatableRoleCatalog> {
-    crate::datatable_roles_oss::read_role_catalog(db, cluster).await
+pub async fn read_role_catalog(db: &DB) -> Result<DatatableRoleCatalog> {
+    crate::datatable_roles_oss::read_role_catalog(db).await
 }
 
 /// As [`read_role_catalog`], reading inside the caller's transaction so the value is the one
 /// [`lock_role_catalog`] is protecting. Same disclosure contract.
 pub async fn read_role_catalog_tx(
     tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
-    cluster: DatatableRoleCluster,
 ) -> Result<DatatableRoleCatalog> {
-    crate::datatable_roles_oss::read_role_catalog_tx(tx, cluster).await
+    crate::datatable_roles_oss::read_role_catalog_tx(tx).await
 }
 
-/// The cluster a role belongs to, or `None` if no role has this id.
-pub async fn role_cluster(
-    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
-    id: &str,
-) -> Result<Option<DatatableRoleCluster>> {
-    crate::datatable_roles_oss::role_cluster(tx, id).await
-}
-
-/// Record a role, in the caller's transaction. On Windmill's own cluster that commits it with the
-/// `CREATE ROLE` it describes; on the external cluster the role already exists by then.
+/// Record a role, in the caller's transaction so it commits with the `CREATE ROLE` it describes.
 ///
 /// Authorization: writes a generated Postgres credential. Callers MUST restrict this to superadmin
 /// paths and MUST hold [`lock_role_catalog`] on `tx`.
 pub async fn insert_role_catalog_entry(
     tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
     id: &str,
-    cluster: DatatableRoleCluster,
     role: &InstanceDatatableRole,
 ) -> Result<()> {
-    crate::datatable_roles_oss::insert_role_catalog_entry(tx, id, cluster, role).await
+    crate::datatable_roles_oss::insert_role_catalog_entry(tx, id, role).await
 }
 
 /// Update a role's recorded name, login flag and password. Same contract as
@@ -274,7 +215,7 @@ pub fn role_id_by_name<'a>(catalog: &'a DatatableRoleCatalog, name: &str) -> Res
         .find(|(_, role)| role.name == name)
         .ok_or_else(|| {
             Error::NotFound(format!(
-                "'{name}' is not a data table role of this database's cluster. Defined roles: {}.",
+                "'{name}' is not a data table role of this instance. Defined roles: {}.",
                 catalog
                     .values()
                     .map(|r| r.name.as_str())
@@ -290,90 +231,70 @@ pub fn role_id_by_name<'a>(catalog: &'a DatatableRoleCatalog, name: &str) -> Res
     Ok(entry.0.as_str())
 }
 
-/// Every database Windmill manages on `cluster`. Role provisioning has to reach all of them: a role
-/// that cannot `CONNECT` to a database is refused by Postgres before any grant matters.
+/// Every instance database the registry knows about. Role provisioning has to reach all of them:
+/// a role that cannot `CONNECT` to a database is refused by Postgres before any grant matters.
 ///
-/// Authorization: checks nothing, and names every managed database across all workspaces. Callers
+/// Authorization: checks nothing, and names every instance database across all workspaces. Callers
 /// MUST be superadmin-gated or keep the names server-side; never return them to a workspace caller.
-pub async fn registered_instance_databases(
-    db: &DB,
-    cluster: DatatableRoleCluster,
-) -> Result<Vec<String>> {
-    crate::datatable_roles_oss::registered_instance_databases(db, cluster).await
+pub async fn registered_instance_databases(db: &DB) -> Result<Vec<String>> {
+    crate::datatable_roles_oss::registered_instance_databases(db).await
 }
 
-/// `CONNECT` on `dbname` for every enabled role of `cluster`, and none for `PUBLIC`. Run at role
-/// creation, at database creation, and lazily whenever a managed data table is administered, so a
-/// database provisioned before a role existed is repaired rather than left silently unreachable.
+/// `CONNECT` on `dbname` for every enabled role, and none for `PUBLIC`. Run at role creation, at
+/// database creation, and lazily whenever an instance data table is administered, so a database
+/// provisioned before a role existed is repaired rather than left silently unreachable.
 ///
 /// Authorization: rewrites a database's ACL with the server's own credentials and checks nothing.
 /// Callers MUST have authorized administration of `dbname` — superadmin, or an admin of the
 /// workspace governing a data table on it.
-pub async fn converge_connect_grants(
-    db: &DB,
-    cluster: DatatableRoleCluster,
-    dbname: &str,
-) -> Result<()> {
-    crate::datatable_roles_oss::converge_connect_grants(db, cluster, dbname).await
+pub async fn converge_connect_grants(db: &DB, dbname: &str) -> Result<()> {
+    crate::datatable_roles_oss::converge_connect_grants(db, dbname).await
 }
 
-/// As [`converge_connect_grants`], with the catalog of `cluster` the caller already read. Same
-/// contract.
+/// As [`converge_connect_grants`], with a catalog the caller already read. Same contract.
 pub async fn converge_connect_grants_with(
     db: &DB,
-    cluster: DatatableRoleCluster,
     dbname: &str,
     catalog: &DatatableRoleCatalog,
 ) -> Result<()> {
-    crate::datatable_roles_oss::converge_connect_grants_with(db, cluster, dbname, catalog).await
+    crate::datatable_roles_oss::converge_connect_grants_with(db, dbname, catalog).await
 }
 
-/// `CREATE ROLE <name> LOGIN PASSWORD ...; GRANT <name> TO custom_instance_user` on `cluster`. No
-/// privileges beyond that — an admin grants them through SQL or the ACL editor.
-///
-/// On Windmill's own cluster the DDL runs on `tx`, so it commits with the catalog row. The external
-/// cluster is another server: the role is created there before `tx` commits, and callers MUST drop
-/// it again ([`drop_datatable_role`]) if `tx` then fails to commit.
+/// `CREATE ROLE <name> LOGIN PASSWORD ...; GRANT <name> TO custom_instance_user`, and `CONNECT` on
+/// every registered database. No privileges beyond that — an admin grants them through SQL or the
+/// ACL editor.
 ///
 /// Authorization: creates a cluster-wide Postgres login. Callers MUST restrict this to superadmin
-/// paths, and MUST hold [`lock_role_catalog`] on `tx`.
-pub async fn create_datatable_role(
-    db: &DB,
+/// paths, and MUST hold [`lock_role_catalog`] on the same transaction.
+pub async fn create_instance_role(
     tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
-    cluster: DatatableRoleCluster,
     name: &str,
     password: &str,
 ) -> Result<()> {
-    crate::datatable_roles_oss::create_datatable_role(db, tx, cluster, name, password).await
+    crate::datatable_roles_oss::create_instance_role(tx, name, password).await
 }
 
 /// Authorization: alters a cluster-wide Postgres login. Callers MUST restrict this to superadmin
-/// paths, and MUST hold [`lock_role_catalog`] on `tx`.
-pub async fn set_datatable_role_login(
-    db: &DB,
+/// paths, and MUST hold [`lock_role_catalog`] on the same transaction.
+pub async fn set_instance_role_login(
     tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
-    cluster: DatatableRoleCluster,
     name: &str,
     enabled: bool,
 ) -> Result<()> {
-    crate::datatable_roles_oss::set_datatable_role_login(db, tx, cluster, name, enabled).await
+    crate::datatable_roles_oss::set_instance_role_login(tx, name, enabled).await
 }
 
-/// A rename discards an md5-hashed password, so the caller has to hand over a fresh one. On the
-/// external cluster the rename lands before `tx` commits, and callers MUST rename it back if `tx`
-/// then fails to commit.
+/// A rename discards an md5-hashed password, so the caller has to hand over a fresh one.
 ///
 /// Authorization: renames a cluster-wide Postgres login. Callers MUST restrict this to superadmin
-/// paths, and MUST hold [`lock_role_catalog`] on `tx`.
-pub async fn rename_datatable_role(
-    db: &DB,
+/// paths, and MUST hold [`lock_role_catalog`] on the same transaction.
+pub async fn rename_instance_role(
     tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
-    cluster: DatatableRoleCluster,
     from: &str,
     to: &str,
     password: &str,
 ) -> Result<()> {
-    crate::datatable_roles_oss::rename_datatable_role(db, tx, cluster, from, to, password).await
+    crate::datatable_roles_oss::rename_instance_role(tx, from, to, password).await
 }
 
 /// A role owning anything in any database blocks its own `DROP ROLE`, and both its objects and the
@@ -381,9 +302,8 @@ pub async fn rename_datatable_role(
 /// registry. An unreachable database aborts the whole delete: dropping the role while one database
 /// still holds objects owned by it leaves those objects owned by a numeric OID nobody can name.
 ///
-/// Each pass runs as the cluster's administrator rather than `custom_instance_user`: on Windmill's
-/// own cluster the instance's Postgres user, on the external one its configured admin login. Both
-/// own the databases and can therefore revoke a grant whoever made it. `custom_instance_user`
+/// Each pass runs as the instance's own Postgres user rather than `custom_instance_user`, which
+/// owns the databases and can therefore revoke a grant whoever made it. `custom_instance_user`
 /// could only undo what it granted itself, so a privilege planted by an operator in psql — the
 /// ordinary way privileges reach a role — would survive and block the drop.
 ///
@@ -391,19 +311,16 @@ pub async fn rename_datatable_role(
 /// MUST restrict this to superadmin paths, and MUST hold [`lock_role_catalog`] on `tx`.
 ///
 /// The per-database passes open their own connections and cannot join `tx`; the lock is what keeps
-/// a concurrent mutation out while they run. On Windmill's own cluster only the final `DROP ROLE`
-/// is on `tx`, so it commits or rolls back with the catalog write that forgets the role; on the
-/// external cluster it runs there, and tolerates a role already gone so a retry after a failed
-/// commit can finish. The passes commit as they go, so callers MUST have disabled the role in an
-/// earlier committed transaction: a failure part-way then leaves a disabled role to retry, not an
-/// enabled one already stripped in some databases.
-pub async fn drop_datatable_role(
+/// a concurrent mutation out while they run. Only the final `DROP ROLE` is on `tx`, so it commits
+/// or rolls back with the catalog write that forgets the role. Those passes commit as they go, so
+/// callers MUST have disabled the role in an earlier committed transaction: a failure part-way
+/// then leaves a disabled role to retry, not an enabled one already stripped in some databases.
+pub async fn drop_instance_role(
     db: &DB,
     tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
-    cluster: DatatableRoleCluster,
     name: &str,
 ) -> Result<()> {
-    crate::datatable_roles_oss::drop_datatable_role(db, tx, cluster, name).await
+    crate::datatable_roles_oss::drop_instance_role(db, tx, name).await
 }
 
 #[cfg(test)]

backend/windmill-common/src/datatable_roles_oss.rs

@@ -24,12 +24,12 @@ pub fn datatable_roles_unavailable() -> Error {
 #[cfg(all(feature = "private", feature = "enterprise"))]
 pub(crate) use crate::datatable_roles_ee::{
     can_use_datatable_role, can_use_datatable_role_in_governing_workspace, converge_connect_grants,
-    converge_connect_grants_with, create_datatable_role, delete_role_catalog_entry,
-    drop_datatable_role, ensure_can_use_datatable_role, ensure_datatable_admin_access,
+    converge_connect_grants_with, create_instance_role, delete_role_catalog_entry,
+    drop_instance_role, ensure_can_use_datatable_role, ensure_datatable_admin_access,
     ensure_instance_db_grant_options_unchecked, forget_datatable_role_everywhere,
     insert_role_catalog_entry, read_role_catalog, read_role_catalog_tx,
-    registered_instance_databases, rename_datatable_role, resolve_datatable_role_connection,
-    role_cluster, set_datatable_role_login, update_role_catalog_entry,
+    registered_instance_databases, rename_instance_role, resolve_datatable_role_connection,
+    set_instance_role_login, update_role_catalog_entry,
 };
 
 #[cfg(not(all(feature = "private", feature = "enterprise")))]
@@ -39,7 +39,7 @@ pub(crate) use ce::*;
 mod ce {
     use super::datatable_roles_unavailable as unavailable;
     use crate::{
-        datatable_roles::{DatatableRoleCatalog, DatatableRoleCluster, InstanceDatatableRole},
+        datatable_roles::{DatatableRoleCatalog, InstanceDatatableRole},
         db::AuthedRef,
         error::Result,
         workspaces::{
@@ -50,31 +50,17 @@ mod ce {
 
     type Tx<'a> = sqlx::Transaction<'a, sqlx::Postgres>;
 
-    pub(crate) async fn read_role_catalog(
-        _db: &DB,
-        _cluster: DatatableRoleCluster,
-    ) -> Result<DatatableRoleCatalog> {
+    pub(crate) async fn read_role_catalog(_db: &DB) -> Result<DatatableRoleCatalog> {
         Err(unavailable())
     }
 
-    pub(crate) async fn read_role_catalog_tx(
-        _tx: &mut Tx<'_>,
-        _cluster: DatatableRoleCluster,
-    ) -> Result<DatatableRoleCatalog> {
-        Err(unavailable())
-    }
-
-    pub(crate) async fn role_cluster(
-        _tx: &mut Tx<'_>,
-        _id: &str,
-    ) -> Result<Option<DatatableRoleCluster>> {
+    pub(crate) async fn read_role_catalog_tx(_tx: &mut Tx<'_>) -> Result<DatatableRoleCatalog> {
         Err(unavailable())
     }
 
     pub(crate) async fn insert_role_catalog_entry(
         _tx: &mut Tx<'_>,
         _id: &str,
-        _cluster: DatatableRoleCluster,
         _role: &InstanceDatatableRole,
     ) -> Result<()> {
         Err(unavailable())
@@ -92,57 +78,43 @@ mod ce {
         Err(unavailable())
     }
 
-    pub(crate) async fn registered_instance_databases(
-        _db: &DB,
-        _cluster: DatatableRoleCluster,
-    ) -> Result<Vec<String>> {
+    pub(crate) async fn registered_instance_databases(_db: &DB) -> Result<Vec<String>> {
         Err(unavailable())
     }
 
-    /// Nothing to converge: with no roles to admit, a managed database keeps the `CONNECT` grants
-    /// it was created with, as it did before roles existed.
-    pub(crate) async fn converge_connect_grants(
-        _db: &DB,
-        _cluster: DatatableRoleCluster,
-        _dbname: &str,
-    ) -> Result<()> {
+    /// Nothing to converge: with no roles to admit, an instance database keeps the `CONNECT`
+    /// grants it was created with, `PUBLIC`'s included, as it did before roles existed.
+    pub(crate) async fn converge_connect_grants(_db: &DB, _dbname: &str) -> Result<()> {
         Ok(())
     }
 
     /// As [`converge_connect_grants`].
     pub(crate) async fn converge_connect_grants_with(
         _db: &DB,
-        _cluster: DatatableRoleCluster,
         _dbname: &str,
         _catalog: &DatatableRoleCatalog,
     ) -> Result<()> {
         Ok(())
     }
 
-    pub(crate) async fn create_datatable_role(
-        _db: &DB,
+    pub(crate) async fn create_instance_role(
         _tx: &mut Tx<'_>,
-        _cluster: DatatableRoleCluster,
         _name: &str,
         _password: &str,
     ) -> Result<()> {
         Err(unavailable())
     }
 
-    pub(crate) async fn set_datatable_role_login(
-        _db: &DB,
+    pub(crate) async fn set_instance_role_login(
         _tx: &mut Tx<'_>,
-        _cluster: DatatableRoleCluster,
         _name: &str,
         _enabled: bool,
     ) -> Result<()> {
         Err(unavailable())
     }
 
-    pub(crate) async fn rename_datatable_role(
-        _db: &DB,
+    pub(crate) async fn rename_instance_role(
         _tx: &mut Tx<'_>,
-        _cluster: DatatableRoleCluster,
         _from: &str,
         _to: &str,
         _password: &str,
@@ -150,18 +122,12 @@ mod ce {
         Err(unavailable())
     }
 
-    pub(crate) async fn drop_datatable_role(
-        _db: &DB,
-        _tx: &mut Tx<'_>,
-        _cluster: DatatableRoleCluster,
-        _name: &str,
-    ) -> Result<()> {
+    pub(crate) async fn drop_instance_role(_db: &DB, _tx: &mut Tx<'_>, _name: &str) -> Result<()> {
         Err(unavailable())
     }
 
     pub(crate) async fn ensure_instance_db_grant_options_unchecked(
         _db: &DB,
-        _cluster: DatatableRoleCluster,
         _dbname: &str,
     ) -> Result<()> {
         Err(unavailable())

backend/windmill-common/src/external_instance_pg.rs

@@ -1,439 +0,0 @@
-/*
- * Author: Ruben Fiszel
- * Copyright: Windmill Labs, Inc 2022
- * This file and its contents are licensed under the AGPLv3 License.
- * Please see the included NOTICE for copyright information and
- * LICENSE-AGPL for a copy of the license.
- */
-
-//! The external Postgres cluster behind `external_instance` data tables and Ducklake catalogs.
-//!
-//! Windmill administers that cluster itself, logged in as the user in
-//! [`EXTERNAL_INSTANCE_PG_SETTING`]. It creates `custom_instance_user` and
-//! `custom_instance_replication_user` there, with passwords it generates and keeps in
-//! [`EXTERNAL_INSTANCE_PG_STATE_SETTING`]. They share their names with the roles on Windmill's own
-//! cluster, but they are different roles with different passwords.
-//!
-//! The cluster may hold data Windmill did not create. Two Windmill instances sharing one is not
-//! supported: each would keep resetting the passwords the other depends on.
-
-use std::collections::{BTreeMap, BTreeSet};
-
-use serde::{Deserialize, Serialize};
-
-use crate::{
-    error::{Error, Result},
-    global_settings::{EXTERNAL_INSTANCE_PG_SETTING, EXTERNAL_INSTANCE_PG_STATE_SETTING},
-    instance_config::{CustomInstanceDb, ExternalInstancePg},
-    DB,
-};
-
-/// What Windmill keeps about the external cluster. Server-managed and hidden: never part of the
-/// instance config, never readable by an agent worker. No `Debug`: it carries live passwords.
-#[derive(Serialize, Deserialize, Clone, Default)]
-pub struct ExternalInstancePgState {
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub user_pwd: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub replication_pwd: Option<String>,
-    /// The databases Windmill created on the cluster. It only ever drops one of these.
-    #[serde(default)]
-    pub databases: BTreeMap<String, CustomInstanceDb>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub last_setup: Option<ExternalInstancePgSetupReport>,
-    /// The cluster ([`external_instance_pg_address`]) the last successful setup converged. Databases
-    /// are only created on a cluster setup succeeded on: the passwords above exist as soon as setup
-    /// first runs, whether or not the cluster accepted them.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub set_up_for: Option<String>,
-}
-
-/// What identifies the cluster a configuration points at. Other fields (admin login, sslmode) can
-/// change without it becoming another cluster.
-pub fn external_instance_pg_address(config: &ExternalInstancePg) -> String {
-    format!(
-        "{}:{}",
-        config.host.trim().to_lowercase(),
-        config.port.unwrap_or(5432)
-    )
-}
-
-#[derive(Serialize, Deserialize, Clone, Debug)]
-pub struct ExternalInstancePgSetupReport {
-    /// No step failed. Warnings leave it true.
-    pub success: bool,
-    pub finished_at: chrono::DateTime<chrono::Utc>,
-    pub steps: Vec<ExternalInstancePgSetupStep>,
-}
-
-#[derive(Serialize, Deserialize, Clone, Debug)]
-pub struct ExternalInstancePgSetupStep {
-    pub name: String,
-    pub status: SetupStepStatus,
-    pub message: String,
-}
-
-#[derive(Serialize, Deserialize, Clone, Copy, Debug, PartialEq, Eq)]
-#[serde(rename_all = "lowercase")]
-pub enum SetupStepStatus {
-    Ok,
-    Warning,
-    Error,
-}
-
-/// The status the settings page shows without running anything.
-#[derive(Serialize, Debug)]
-pub struct ExternalInstancePgStatus {
-    pub configured: bool,
-    pub database_count: usize,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub last_setup: Option<ExternalInstancePgSetupReport>,
-}
-
-/// Authorization: returns the cluster's admin password and checks nothing. Callers MUST be
-/// superadmin or an internal server path.
-pub(crate) async fn read_external_instance_pg_config<'c>(
-    executor: impl sqlx::PgExecutor<'c>,
-) -> Result<Option<ExternalInstancePg>> {
-    let value = sqlx::query_scalar!(
-        "SELECT value FROM global_settings WHERE name = $1",
-        EXTERNAL_INSTANCE_PG_SETTING
-    )
-    .fetch_optional(executor)
-    .await?;
-    value
-        .map(|v| {
-            serde_json::from_value(v).map_err(|e| {
-                Error::internal_err(format!("reading {EXTERNAL_INSTANCE_PG_SETTING}: {e}"))
-            })
-        })
-        .transpose()
-}
-
-/// Authorization: returns the passwords Windmill generated on the cluster and checks nothing.
-/// Callers MUST be superadmin or an internal server path.
-pub(crate) async fn read_external_instance_pg_state<'c>(
-    executor: impl sqlx::PgExecutor<'c>,
-) -> Result<ExternalInstancePgState> {
-    let value = sqlx::query_scalar!(
-        "SELECT value FROM global_settings WHERE name = $1",
-        EXTERNAL_INSTANCE_PG_STATE_SETTING
-    )
-    .fetch_optional(executor)
-    .await?;
-    match value {
-        None => Ok(ExternalInstancePgState::default()),
-        Some(v) => serde_json::from_value(v).map_err(|e| {
-            Error::internal_err(format!("reading {EXTERNAL_INSTANCE_PG_STATE_SETTING}: {e}"))
-        }),
-    }
-}
-
-pub async fn external_instance_pg_status(db: &DB) -> Result<ExternalInstancePgStatus> {
-    let configured = read_external_instance_pg_config(db).await?.is_some();
-    let state = read_external_instance_pg_state(db).await?;
-    Ok(ExternalInstancePgStatus {
-        configured,
-        database_count: state.databases.len(),
-        last_setup: state.last_setup,
-    })
-}
-
-/// The databases Windmill created on the external cluster, without the passwords kept beside them.
-///
-/// Authorization: names every database across all workspaces, and the workspace each fork copy is
-/// reserved for, and checks nothing. Callers MUST be superadmin or an internal authorization or
-/// lifecycle path that does not return the names to a workspace caller.
-pub async fn external_instance_databases(db: &DB) -> Result<BTreeMap<String, CustomInstanceDb>> {
-    Ok(read_external_instance_pg_state(db).await?.databases)
-}
-
-/// The workspaces whose data tables or Ducklake catalogs name each database on the external cluster,
-/// and the forks whose Ducklake metadata schemas there are still waiting to be dropped: those rows
-/// outlive a settings change, and cleanup cannot drop a schema in a database that is gone. A row
-/// whose schema is already dropped only waits on object storage, which needs no database.
-///
-/// Authorization: reads every workspace's settings and checks nothing. Callers MUST be superadmin
-/// or an internal lifecycle path.
-pub async fn external_instance_database_usages<'c>(
-    db: impl sqlx::PgExecutor<'c>,
-) -> Result<BTreeMap<String, BTreeSet<String>>> {
-    let rows = sqlx::query_as::<_, (String, String)>(
-        "SELECT ws.workspace_id, entry->'database'->>'resource_path'
-         FROM workspace_settings ws
-         CROSS JOIN LATERAL jsonb_each(
-             CASE WHEN jsonb_typeof(ws.datatable->'datatables') = 'object'
-                 THEN ws.datatable->'datatables'
-                 ELSE '{}'::jsonb END
-         ) AS dt(k, entry)
-         WHERE entry->'database'->>'resource_type' = 'external_instance'
-           AND entry->'database'->>'resource_path' IS NOT NULL
-         UNION ALL
-         SELECT ws.workspace_id, entry->'catalog'->>'resource_path'
-         FROM workspace_settings ws
-         CROSS JOIN LATERAL jsonb_each(
-             CASE WHEN jsonb_typeof(ws.ducklake->'ducklakes') = 'object'
-                 THEN ws.ducklake->'ducklakes'
-                 ELSE '{}'::jsonb END
-         ) AS dl(k, entry)
-         WHERE entry->'catalog'->>'resource_type' = 'external_instance'
-           AND entry->'catalog'->>'resource_path' IS NOT NULL
-         UNION ALL
-         SELECT workspace_id, substring(catalog FROM length('external_instance:') + 1)
-         FROM fork_ducklake_namespace
-         WHERE catalog LIKE 'external\\_instance:%' AND NOT schema_dropped",
-    )
-    .fetch_all(db)
-    .await?;
-    let mut usages: BTreeMap<String, BTreeSet<String>> = BTreeMap::new();
-    for (workspace_id, dbname) in rows {
-        usages.entry(dbname).or_default().insert(workspace_id);
-    }
-    Ok(usages)
-}
-
-/// Refuse to unset the cluster while Windmill still has databases or data table roles on it, or a
-/// workspace still points at one: every data table there would stop resolving, and every role
-/// would be a login nothing can drop any more. Allowed on every edition, so a
-/// downgraded instance can still clear a setting it no longer uses.
-pub async fn ensure_external_instance_pg_removable(db: &DB) -> Result<()> {
-    ensure_external_instance_pg_unused(db, &format!("removing {EXTERNAL_INSTANCE_PG_SETTING}"))
-        .await
-}
-
-/// Refuse while Windmill has databases or data table roles on the cluster, or a workspace points
-/// at one of its databases. `before` finishes the sentence saying what to do first.
-async fn ensure_external_instance_pg_unused(db: &DB, before: &str) -> Result<()> {
-    let state = read_external_instance_pg_state(db).await?;
-    let usages = external_instance_database_usages(db).await?;
-    let roles = sqlx::query_scalar::<_, String>(
-        "SELECT name FROM datatable_role WHERE cluster = 'external_instance' ORDER BY name",
-    )
-    .fetch_all(db)
-    .await?;
-    if state.databases.is_empty() && usages.is_empty() && roles.is_empty() {
-        return Ok(());
-    }
-    let mut held = vec![];
-    if !(state.databases.is_empty() && usages.is_empty()) {
-        let names = state
-            .databases
-            .keys()
-            .chain(usages.keys())
-            .collect::<BTreeSet<_>>()
-            .into_iter()
-            .cloned()
-            .collect::<Vec<_>>()
-            .join(", ");
-        held.push(format!("databases in use ({names})"));
-    }
-    if !roles.is_empty() {
-        held.push(format!("data table roles ({})", roles.join(", ")));
-    }
-    Err(Error::BadRequest(format!(
-        "The external instance cluster still holds {}. Drop them and repoint the data tables and \
-         Ducklake catalogs using them before {before}.",
-        held.join(" and ")
-    )))
-}
-
-/// Refuse a workspace setting that newly names an `external_instance` database on an edition
-/// without them.
-pub fn ensure_external_instance_available() -> Result<()> {
-    crate::external_instance_pg_oss::ensure_external_instance_available()
-}
-
-/// The connection an `external_instance` database resolves to: `custom_instance_user`, or the
-/// replication user, on the external cluster.
-///
-/// Authorization: returns live credentials and checks nothing. Callers MUST have authorized access
-/// to the data table that names `dbname`.
-pub async fn external_instance_connection_unchecked(
-    db: &DB,
-    dbname: &str,
-    replication: bool,
-) -> Result<crate::PgDatabase> {
-    crate::external_instance_pg_oss::external_instance_connection_unchecked(db, dbname, replication)
-        .await
-}
-
-/// Create `dbname` on the external cluster and register it. Refuses a name already taken there,
-/// whoever took it.
-///
-/// Authorization: checks nothing. Callers MUST be superadmin, or be cloning a data table they may
-/// fork into a `wm_fork_` database.
-pub async fn create_external_instance_database_unchecked(
-    db: &DB,
-    dbname: &str,
-    tag: &str,
-    for_workspace: Option<&str>,
-) -> Result<()> {
-    crate::external_instance_pg_oss::create_external_instance_database_unchecked(
-        db,
-        dbname,
-        tag,
-        for_workspace,
-    )
-    .await
-}
-
-/// Drop `dbname` from the external cluster: only a database Windmill registered creating, and still
-/// carries the mark it set there. Refused while anything uses it
-/// ([`crate::workspaces::managed_database_uses`]), except the `exempt` data table entry: the fork
-/// copy being cleaned up.
-///
-/// Authorization: checks nothing. Callers MUST be superadmin, or be deleting the fork that owns
-/// this `wm_fork_` database.
-pub async fn drop_external_instance_database_unchecked(
-    db: &DB,
-    dbname: &str,
-    exempt: Option<(&str, &str)>,
-) -> Result<()> {
-    crate::external_instance_pg_oss::drop_external_instance_database_unchecked(db, dbname, exempt)
-    .await
-}
-
-/// Serializes everything that changes which databases exist on the external cluster, or which data
-/// tables name them: setup, creates, drops, and data table saves. Held until `tx` ends.
-pub async fn lock_external_instance_pg_state(
-    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
-) -> Result<()> {
-    sqlx::query("SELECT pg_advisory_xact_lock(hashtext($1))")
-        .bind(EXTERNAL_INSTANCE_PG_STATE_SETTING)
-        .execute(&mut **tx)
-        .await?;
-    Ok(())
-}
-
-/// Refuse a data table naming `dbname` unless Windmill created it on the external cluster. Takes
-/// the lock drops take, so none can remove the database before `tx`, which saves the data table,
-/// commits.
-pub async fn ensure_external_instance_database_registered(
-    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
-    dbname: &str,
-) -> Result<()> {
-    lock_external_instance_pg_state(tx).await?;
-    if read_external_instance_pg_state(&mut **tx)
-        .await?
-        .databases
-        .contains_key(dbname)
-    {
-        return Ok(());
-    }
-    Err(Error::BadRequest(format!(
-        "Windmill did not create a database named '{dbname}' on the external instance cluster. \
-         Create it from the instance settings first."
-    )))
-}
-
-/// Write [`EXTERNAL_INSTANCE_PG_SETTING`]: `None`, null or an empty string unsets it. Every writer
-/// of global settings goes through this for that key — the per-key and bulk endpoints as well as
-/// the declarative sync — instead of writing the row itself.
-///
-/// The checks and the write share one transaction holding [`lock_external_instance_pg_state`]. A
-/// check taken outside it could pass while a database create still reads the old cluster, which
-/// would then register a database there after the setting names another one.
-///
-/// Authorization: checks nothing. Callers MUST be superadmin, or the declarative instance config
-/// sync, which applies what the operator deployed.
-pub async fn write_external_instance_pg_setting(
-    db: &DB,
-    value: Option<&serde_json::Value>,
-) -> Result<()> {
-    let value = match value {
-        None | Some(serde_json::Value::Null) => None,
-        Some(serde_json::Value::String(s)) if s.trim().is_empty() => None,
-        Some(value) => Some(value),
-    };
-    let mut tx = db.begin().await?;
-    lock_external_instance_pg_state(&mut tx).await?;
-    match value {
-        None => {
-            ensure_external_instance_pg_removable(db).await?;
-            sqlx::query("DELETE FROM global_settings WHERE name = $1")
-                .bind(EXTERNAL_INSTANCE_PG_SETTING)
-                .execute(&mut *tx)
-                .await?;
-        }
-        Some(value) => {
-            crate::external_instance_pg_oss::validate_external_instance_pg_setting(value)?;
-            ensure_external_instance_pg_not_repointed(db, value).await?;
-            sqlx::query(
-                "INSERT INTO global_settings (name, value) VALUES ($1, $2)
-                 ON CONFLICT (name) DO UPDATE SET value = EXCLUDED.value, updated_at = now()",
-            )
-            .bind(EXTERNAL_INSTANCE_PG_SETTING)
-            .bind(value)
-            .execute(&mut *tx)
-            .await?;
-        }
-    }
-    tx.commit().await?;
-    tracing::info!(
-        "{} global setting {EXTERNAL_INSTANCE_PG_SETTING}",
-        if value.is_some() { "Set" } else { "Unset" }
-    );
-    Ok(())
-}
-
-/// [`write_external_instance_pg_setting`] for a settings diff: writes the key if the diff touches
-/// it, and takes it out of the diff so the generic apply does not write it again.
-///
-/// Authorization: checks nothing. Callers MUST be superadmin, or the declarative instance config
-/// sync, which applies what the operator deployed.
-pub async fn write_external_instance_pg_from_diff(
-    db: &DB,
-    diff: &mut crate::instance_config::SettingsDiff,
-) -> Result<()> {
-    if let Some(value) = diff.upserts.remove(EXTERNAL_INSTANCE_PG_SETTING) {
-        write_external_instance_pg_setting(db, Some(&value)).await?;
-    }
-    if let Some(i) = diff
-        .deletes
-        .iter()
-        .position(|k| k == EXTERNAL_INSTANCE_PG_SETTING)
-    {
-        diff.deletes.remove(i);
-        write_external_instance_pg_setting(db, None).await?;
-    }
-    Ok(())
-}
-
-/// Refuse pointing the setting at another host or port while databases or data table roles live on
-/// the current one. Data tables name databases, and the role catalog names logins, not clusters, so
-/// both would silently resolve to whatever the new cluster holds under the same names. Other fields
-/// (admin login, sslmode) may change freely.
-async fn ensure_external_instance_pg_not_repointed(
-    db: &DB,
-    value: &serde_json::Value,
-) -> Result<()> {
-    let Some(current) = read_external_instance_pg_config(db).await? else {
-        return Ok(());
-    };
-    let Ok(desired) = serde_json::from_value::<ExternalInstancePg>(value.clone()) else {
-        return Ok(());
-    };
-    if external_instance_pg_address(&current) == external_instance_pg_address(&desired) {
-        return Ok(());
-    }
-    ensure_external_instance_pg_unused(
-        db,
-        &format!("pointing {EXTERNAL_INSTANCE_PG_SETTING} at another cluster"),
-    )
-    .await
-}
-
-/// Converge the external cluster on the configured login: check what it can do, create or update
-/// Windmill's two roles with the stored passwords, and report anything that would get in the way.
-/// With `rotate_passwords`, generate new passwords first. Safe to run again; running it again is
-/// how a failed rotation is repaired.
-///
-/// Authorization: administers the external cluster with its admin credentials and checks nothing.
-/// Callers MUST be superadmin.
-pub async fn setup_external_instance_pg_unchecked(
-    db: &DB,
-    rotate_passwords: bool,
-) -> Result<ExternalInstancePgSetupReport> {
-    crate::external_instance_pg_oss::setup_external_instance_pg_unchecked(db, rotate_passwords)
-        .await
-}

backend/windmill-common/src/external_instance_pg_oss.rs

@@ -1,81 +0,0 @@
-/*
- * Author: Ruben Fiszel
- * Copyright: Windmill Labs, Inc 2022
- * This file and its contents are licensed under the AGPLv3 License.
- * Please see the included NOTICE for copyright information and
- * LICENSE-AGPL for a copy of the license.
- */
-
-//! Where the external instance cluster comes from: the enterprise implementation, or a refusal.
-//! `private` alone is not that edition: community builds carry it.
-
-use crate::error::Error;
-
-pub fn external_instance_pg_unavailable() -> Error {
-    Error::BadRequest(
-        "External instance databases are a Windmill Enterprise Edition feature".to_string(),
-    )
-}
-
-#[cfg(all(feature = "private", feature = "enterprise"))]
-pub(crate) use crate::external_instance_pg_ee::{
-    create_external_instance_database_unchecked, drop_external_instance_database_unchecked,
-    external_instance_connection_unchecked, setup_external_instance_pg_unchecked,
-    validate_external_instance_pg_setting,
-};
-
-#[cfg(all(feature = "private", feature = "enterprise"))]
-pub(crate) fn ensure_external_instance_available() -> crate::error::Result<()> {
-    Ok(())
-}
-
-#[cfg(not(all(feature = "private", feature = "enterprise")))]
-pub(crate) use ce::*;
-
-#[cfg(not(all(feature = "private", feature = "enterprise")))]
-mod ce {
-    use super::external_instance_pg_unavailable as unavailable;
-    use crate::{
-        error::Result, external_instance_pg::ExternalInstancePgSetupReport, PgDatabase, DB,
-    };
-
-    pub(crate) fn validate_external_instance_pg_setting(_value: &serde_json::Value) -> Result<()> {
-        Err(unavailable())
-    }
-
-    pub(crate) fn ensure_external_instance_available() -> Result<()> {
-        Err(unavailable())
-    }
-
-    pub(crate) async fn setup_external_instance_pg_unchecked(
-        _db: &DB,
-        _rotate_passwords: bool,
-    ) -> Result<ExternalInstancePgSetupReport> {
-        Err(unavailable())
-    }
-
-    pub(crate) async fn external_instance_connection_unchecked(
-        _db: &DB,
-        _dbname: &str,
-        _replication: bool,
-    ) -> Result<PgDatabase> {
-        Err(unavailable())
-    }
-
-    pub(crate) async fn create_external_instance_database_unchecked(
-        _db: &DB,
-        _dbname: &str,
-        _tag: &str,
-        _for_workspace: Option<&str>,
-    ) -> Result<()> {
-        Err(unavailable())
-    }
-
-    pub(crate) async fn drop_external_instance_database_unchecked(
-        _db: &DB,
-        _dbname: &str,
-        _exempt: Option<(&str, &str)>,
-    ) -> Result<()> {
-        Err(unavailable())
-    }
-}

backend/windmill-common/src/global_settings.rs

@@ -57,8 +57,6 @@ pub const SAML_METADATA_SETTING: &str = "saml_metadata";
 pub const SMTP_SETTING: &str = "smtp_settings";
 pub const TEAMS_SETTING: &str = "teams";
 pub const INDEXER_SETTING: &str = "indexer_settings";
-pub const EXTERNAL_INSTANCE_PG_SETTING: &str = "external_instance_pg";
-pub const EXTERNAL_INSTANCE_PG_STATE_SETTING: &str = "external_instance_pg_state";
 pub const TIMEOUT_WAIT_RESULT_SETTING: &str = "timeout_wait_result";
 
 pub const UNIQUE_ID_SETTING: &str = "uid";
@@ -357,9 +355,6 @@ pub const AGENT_WORKER_BLOCKED_SETTINGS: &[&str] = &[
     // resolve datatable connections through the dedicated datatable endpoints, never these.
     "custom_instance_pg_databases",
     "custom_instance_replication_pwd",
-    // The external cluster's admin login, and the passwords Windmill generated on it.
-    EXTERNAL_INSTANCE_PG_SETTING,
-    EXTERNAL_INSTANCE_PG_STATE_SETTING,
 ];
 
 /// Whether an agent worker may read the given global setting over HTTP.

backend/windmill-common/src/instance_config.rs

@@ -350,8 +350,6 @@ pub struct GlobalSettings {
     pub ducklake_settings: Option<DucklakeSettings>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub custom_instance_pg_databases: Option<CustomInstancePgDatabases>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub external_instance_pg: Option<ExternalInstancePg>,
 
     // Opaque settings (EE-private structs or no clear schema)
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -838,36 +836,6 @@ pub struct CustomInstanceDbLogs {
     pub replication_user_error: Option<String>,
 }
 
-// ---------------------------------------------------------------------------
-// External instance PG cluster
-// ---------------------------------------------------------------------------
-
-/// The external Postgres cluster Windmill manages for `external_instance` data tables and Ducklake
-/// catalogs. `user` logs in as the cluster's administrator: it needs `CREATEDB` and `CREATEROLE`.
-/// `dbname` is only where that login connects to run cluster-wide statements.
-///
-/// Every field defaults rather than being required: this deserializes as part of the whole
-/// instance config, and one malformed row must not make every other setting unreadable. The
-/// write path and every use reject an incomplete value instead.
-#[derive(Deserialize, Serialize, Clone, Debug, Default)]
-#[cfg_attr(feature = "instance_config_schema", derive(schemars::JsonSchema))]
-pub struct ExternalInstancePg {
-    #[serde(default)]
-    pub host: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub port: Option<u16>,
-    #[serde(default)]
-    pub user: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub password: Option<StringOrSecretRef>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub dbname: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub sslmode: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub root_certificate_pem: Option<String>,
-}
-
 // ---------------------------------------------------------------------------
 // Autoscaling (worker config)
 // ---------------------------------------------------------------------------
@@ -1004,7 +972,6 @@ pub const PROTECTED_SETTINGS: &[&str] = &[
     "ducklake_settings",
     "custom_instance_pg_databases",
     "custom_instance_replication_pwd",
-    "external_instance_pg_state",
     "uid",
     "rsa_keys",
     "jwt_secret",
@@ -1030,8 +997,6 @@ pub const HIDDEN_SETTINGS: &[&str] = &[
     // Server-only (written by setup/refresh via direct SQL), never operator-authored —
     // hidden so the config machinery can't read, rewrite, or drop it.
     "custom_instance_replication_pwd",
-    // Same for the passwords and database registry Windmill keeps for the external cluster.
-    "external_instance_pg_state",
 ];
 
 /// Top-level settings whose entire value is sensitive and must be fully redacted in logs.
@@ -1043,7 +1008,6 @@ const SENSITIVE_SETTINGS: &[&str] = &[
     "license_key",
     "ducklake_user_pg_pwd",
     "custom_instance_replication_pwd",
-    "external_instance_pg_state",
     "pip_index_url",
     "pip_extra_index_url",
     "npm_config_registry",
@@ -1069,7 +1033,6 @@ const NESTED_SENSITIVE_FIELDS: &[(&str, &[&str])] = &[
         &["secret_key", "serviceAccountKey"],
     ),
     ("custom_instance_pg_databases", &["user_pwd"]),
-    ("external_instance_pg", &["password"]),
 ];
 
 fn redact_json_value(value: &serde_json::Value) -> serde_json::Value {
@@ -1398,8 +1361,7 @@ pub async fn sync_global_settings_declarative(
     crate::global_settings::parse_allowed_origins_setting(desired.get(origins_key))
         .map_err(|e| anyhow::anyhow!("{origins_key}: {e}"))?;
 
-    let mut diff = diff_global_settings(current, desired, ApplyMode::Replace);
-    crate::external_instance_pg::write_external_instance_pg_from_diff(db, &mut diff).await?;
+    let diff = diff_global_settings(current, desired, ApplyMode::Replace);
     apply_settings_diff(db, &diff).await?;
 
     Ok(())
@@ -1532,10 +1494,6 @@ pub fn resolve_env_refs(settings: &mut GlobalSettings) -> Result<(), String> {
         resolve_env_option(&mut pg.user_pwd)?;
     }
 
-    if let Some(pg) = &mut settings.external_instance_pg {
-        resolve_env_option(&mut pg.password)?;
-    }
-
     Ok(())
 }
 
@@ -2505,33 +2463,39 @@ mod tests {
     }
 
     #[test]
-    fn server_generated_db_passwords_are_isolated_from_config() {
-        // These hold passwords the server generates: written by setup/refresh via direct SQL,
-        // never operator-authored. They must stay out of the declarative config surface
-        // (hidden on read) and be undeletable, so config sync can't read, rewrite, or drop them.
-        for key in [
-            "custom_instance_replication_pwd",
-            "external_instance_pg_state",
-        ] {
-            assert!(HIDDEN_SETTINGS.contains(&key), "{key}");
-            assert!(PROTECTED_SETTINGS.contains(&key), "{key}");
-            assert!(SENSITIVE_SETTINGS.contains(&key), "{key}");
+    fn custom_instance_replication_pwd_is_isolated_from_config() {
+        // The replication-role password is server-only: written by setup/refresh via direct
+        // SQL, never operator-authored. It must stay out of the declarative config surface
+        // (hidden on read) and be undeletable, so config sync can't read, rewrite, or drop it.
+        assert!(HIDDEN_SETTINGS.contains(&"custom_instance_replication_pwd"));
+        assert!(PROTECTED_SETTINGS.contains(&"custom_instance_replication_pwd"));
+        assert!(SENSITIVE_SETTINGS.contains(&"custom_instance_replication_pwd"));
 
-            // A stray desired value (e.g. flattened into `extra`) is ignored, not upserted.
-            let mut desired = BTreeMap::new();
-            desired.insert(key.to_string(), serde_json::json!("attacker-set"));
-            let diff = diff_global_settings(&BTreeMap::new(), &desired, ApplyMode::Merge);
-            assert!(diff.upserts.is_empty(), "{key} must not be upserted");
+        // A stray desired value (e.g. flattened into `extra`) is ignored, not upserted.
+        let mut desired = BTreeMap::new();
+        desired.insert(
+            "custom_instance_replication_pwd".to_string(),
+            serde_json::json!("attacker-set"),
+        );
+        let diff = diff_global_settings(&BTreeMap::new(), &desired, ApplyMode::Merge);
+        assert!(
+            diff.upserts.is_empty(),
+            "hidden setting must not be upserted"
+        );
 
-            // A current value is never deleted by a Replace that omits it.
-            let mut current = BTreeMap::new();
-            current.insert(key.to_string(), serde_json::json!("live"));
-            let diff = diff_global_settings(&current, &BTreeMap::new(), ApplyMode::Replace);
-            assert!(
-                !diff.deletes.contains(&key.to_string()),
-                "{key} must not be deleted"
-            );
-        }
+        // A current value is never deleted by a Replace that omits it.
+        let mut current = BTreeMap::new();
+        current.insert(
+            "custom_instance_replication_pwd".to_string(),
+            serde_json::json!("live"),
+        );
+        let diff = diff_global_settings(&current, &BTreeMap::new(), ApplyMode::Replace);
+        assert!(
+            !diff
+                .deletes
+                .contains(&"custom_instance_replication_pwd".to_string()),
+            "hidden setting must not be deleted"
+        );
     }
 
     #[test]

backend/windmill-common/src/lib.rs

@@ -58,10 +58,6 @@ pub mod ee_oss;
 pub mod email_ee;
 pub mod email_oss;
 pub mod error;
-pub mod external_instance_pg;
-#[cfg(all(feature = "private", feature = "enterprise"))]
-mod external_instance_pg_ee;
-pub mod external_instance_pg_oss;
 pub mod external_ip;
 #[cfg(feature = "private")]
 pub mod feature_usage_ee;
@@ -1086,13 +1082,7 @@ impl PgDatabase {
                 if err_str.contains("password authentication failed for user")
                     && err_str.contains("custom_instance_user")
                 {
-                    // The external instance cluster has a `custom_instance_user` of its own, whose
-                    // password setup manages. Rotating the local one would break every instance
-                    // data table and fix nothing.
-                    let local = PgDatabase::parse_uri(&get_database_url().await?.as_str().await)?;
-                    let on_local_cluster = local.host == self.host
-                        && local.port.unwrap_or(5432) == self.port.unwrap_or(5432);
-                    if let Some(db) = main_db.filter(|_| on_local_cluster) {
+                    if let Some(db) = main_db {
                         tracing::warn!(
                             "custom_instance_user password auth failed, refreshing and retrying..."
                         );
@@ -1485,7 +1475,26 @@ pub fn validate_dbname(dbname: &str) -> error::Result<()> {
 }
 
 /// Drop a custom instance database: validate, terminate connections, DROP DATABASE, remove from global_settings.
+///
+/// Authorization: drops any instance database but Windmill's own and checks nothing. Callers MUST
+/// be superadmin, or have established the caller may drop this one — a fork's owner cleaning up
+/// its own copy that nothing else uses.
 pub async fn drop_custom_instance_database(db: &DB, dbname: &str) -> error::Result<()> {
+    drop_custom_instance_database_keep_entry(db, dbname).await?;
+    sqlx::query!(
+        r#"UPDATE global_settings SET value = value #- ARRAY['databases', $1] WHERE name = 'custom_instance_pg_databases'"#,
+        dbname.trim()
+    )
+    .execute(db)
+    .await?;
+    Ok(())
+}
+
+/// [`drop_custom_instance_database`] leaving its registry entry, for a caller holding row locks in
+/// a transaction: the registry write has to go through that transaction, as waiting on another
+/// connection for a lock the transaction's own peers hold is a deadlock Postgres cannot see. Same
+/// authorization contract.
+pub async fn drop_custom_instance_database_keep_entry(db: &DB, dbname: &str) -> error::Result<()> {
     let dbname = dbname.trim();
     validate_dbname(dbname)?;
 
@@ -1531,14 +1540,6 @@ pub async fn drop_custom_instance_database(db: &DB, dbname: &str) -> error::Resu
         tracing::info!("Database '{}' does not exist, skipping drop", dbname);
     }
 
-    // Always remove from global_settings
-    sqlx::query!(
-        r#"UPDATE global_settings SET value = value #- ARRAY['databases', $1] WHERE name = 'custom_instance_pg_databases'"#,
-        dbname
-    )
-    .execute(db)
-    .await?;
-
     Ok(())
 }
 
@@ -1563,20 +1564,18 @@ pub(crate) fn instance_db_grants(dbname: &str) -> String {
     )
 }
 
-/// Re-apply [`instance_db_grants`] to a managed database provisioned before data table roles
-/// existed, whose grants carry no grant option. Connects as the cluster's administrator — the
-/// database and `public` schema owner — since only it can hand out an option it holds.
+/// Re-apply [`instance_db_grants`] to an instance database provisioned before data table roles
+/// existed, whose grants carry no grant option. Connects as the instance's own Postgres user —
+/// the database and `public` schema owner — since only it can hand out an option it holds.
 ///
-/// Authorization: reaches a managed database with the server's own credentials and checks
+/// Authorization: reaches an instance database with the server's own credentials and checks
 /// nothing. Callers MUST have authorized administration of `dbname` — superadmin, or an admin of
 /// the workspace governing a data table on it.
 pub async fn ensure_instance_db_grant_options_unchecked(
     db: &DB,
-    cluster: crate::datatable_roles::DatatableRoleCluster,
     dbname: &str,
 ) -> error::Result<()> {
-    crate::datatable_roles_oss::ensure_instance_db_grant_options_unchecked(db, cluster, dbname)
-        .await
+    crate::datatable_roles_oss::ensure_instance_db_grant_options_unchecked(db, dbname).await
 }
 
 /// Create a custom instance database: CREATE DATABASE, grant permissions, register in global_settings.
@@ -1653,13 +1652,7 @@ pub async fn create_custom_instance_database(
     // A data table role can only reach a database it may CONNECT to, and PUBLIC's default CONNECT
     // would otherwise let every role in regardless of what this instance defines. Best-effort: a
     // failure here leaves the database usable as `admin`, and the next role change repairs it.
-    if let Err(e) = crate::datatable_roles::converge_connect_grants(
-        db,
-        crate::datatable_roles::DatatableRoleCluster::Instance,
-        dbname,
-    )
-    .await
-    {
+    if let Err(e) = crate::datatable_roles::converge_connect_grants(db, dbname).await {
         tracing::warn!("Could not set CONNECT grants on instance database '{dbname}': {e}");
     }
 
@@ -1667,62 +1660,39 @@ pub async fn create_custom_instance_database(
     Ok(())
 }
 
-/// The system's CA bundle file, for libpq clients that cannot take `sslrootcert=system`: that value
-/// needs libpq 16, and verify-full only.
-pub fn system_ca_bundle() -> Option<std::path::PathBuf> {
-    std::env::var_os("SSL_CERT_FILE")
-        .map(std::path::PathBuf::from)
-        .into_iter()
-        .chain(
-            [
-                "/etc/ssl/certs/ca-certificates.crt",
-                "/etc/pki/tls/certs/ca-bundle.crt",
-                "/etc/ssl/cert.pem",
-                "/etc/ssl/ca-bundle.pem",
-            ]
-            .map(std::path::PathBuf::from),
-        )
-        .find(|path| path.is_file())
-}
-
-/// Refuse a workspace member writing a fork copy into, or pointing a fork at, the managed database
-/// `dbname` of `kind`, unless `w_id` created it for that ([`create_custom_instance_database`], or
-/// its external instance counterpart) and nothing uses it yet. The `wm_fork_` prefix is no
-/// authorization: every database of a cluster answers to the same `custom_instance_user`, so a name
-/// is all it takes to reach another workspace's copy.
+/// Refuse a workspace member writing a fork copy into, or pointing a fork at, the instance database
+/// `dbname`, unless `w_id` created it for that ([`create_custom_instance_database`]) and nothing uses
+/// it yet. The `wm_fork_` prefix is no authorization: every instance database answers to the same
+/// `custom_instance_user`, so a name is all it takes to reach another workspace's copy.
 ///
-/// Authorization: reads the global registries and every workspace's settings, and names other
+/// Authorization: reads the global registry and every workspace's settings, and names other
 /// workspaces in its refusal. Callers MUST have authorized `w_id` for the caller first — a member
 /// of it forking or importing there — and MUST NOT call it on a workspace the caller is not in.
 pub async fn ensure_fork_database_available_to(
     db: &DB,
-    kind: workspaces::DataTableCatalogResourceType,
     dbname: &str,
     w_id: &str,
 ) -> error::Result<()> {
-    let created_for = match kind {
-        workspaces::DataTableCatalogResourceType::ExternalInstance => {
-            external_instance_pg::external_instance_databases(db)
-                .await?
-                .remove(dbname)
-                .and_then(|entry| entry.workspace_id)
-        }
-        _ => sqlx::query_scalar::<_, Option<String>>(
-            "SELECT value->'databases'->$1->>'workspace_id' FROM global_settings
-             WHERE name = 'custom_instance_pg_databases'",
-        )
-        .bind(dbname)
-        .fetch_optional(db)
-        .await?
-        .flatten(),
-    };
+    let created_for = sqlx::query_scalar::<_, Option<String>>(
+        "SELECT value->'databases'->$1->>'workspace_id' FROM global_settings
+         WHERE name = 'custom_instance_pg_databases'",
+    )
+    .bind(dbname)
+    .fetch_optional(db)
+    .await?
+    .flatten();
     if created_for.as_deref() != Some(w_id) {
         return Err(Error::BadRequest(format!(
             "Database '{dbname}' was not created for a fork of workspace '{w_id}'"
         )));
     }
-    let uses =
-        workspaces::managed_database_uses(&mut *db.acquire().await?, kind, dbname, None).await?;
+    let uses = workspaces::managed_database_uses(
+        &mut *db.acquire().await?,
+        workspaces::DataTableCatalogResourceType::Instance,
+        dbname,
+        None,
+    )
+    .await?;
     if !uses.is_empty() {
         return Err(Error::BadRequest(format!(
             "Database '{dbname}' is already in use: {}",

backend/windmill-common/src/workspaces.rs

@@ -1397,18 +1397,6 @@ pub enum DataTableCatalogResourceType {
     #[strum(serialize = "postgres")]
     Postgresql,
     Instance,
-    /// On the external instance cluster ([`crate::external_instance_pg`]). Enterprise Edition.
-    #[serde(rename = "external_instance")]
-    #[strum(serialize = "external_instance")]
-    ExternalInstance,
-}
-
-impl DataTableCatalogResourceType {
-    /// A database Windmill created and administers, on its own cluster or the external one, as
-    /// opposed to one a user brought as a resource.
-    pub fn is_windmill_managed(self) -> bool {
-        matches!(self, Self::Instance | Self::ExternalInstance)
-    }
 }
 
 /// Build a self-teaching error for an unresolved `datatable://<name>` reference.
@@ -1551,14 +1539,13 @@ pub async fn lock_fork_datatables(conn: &mut sqlx::PgConnection, w_id: &str) ->
 }
 
 impl GoverningDatatable {
-    /// The Windmill-managed cluster whose data table roles this entry can use. `None` for a
-    /// resource-backed one: roles are logins Windmill creates, and it creates none on a host a
-    /// workspace admin chose.
-    pub fn role_cluster(&self) -> Option<crate::datatable_roles::DatatableRoleCluster> {
+    /// Backed by the Windmill instance's own Postgres, which is the only substrate data table
+    /// roles apply to.
+    pub fn is_instance(&self) -> bool {
         self.datatable
             .database
             .as_ref()
-            .and_then(|d| crate::datatable_roles::DatatableRoleCluster::of(d.resource_type))
+            .is_some_and(|d| d.resource_type == DataTableCatalogResourceType::Instance)
     }
 }
 
@@ -1693,8 +1680,7 @@ pub async fn resolve_workspace_governing_datatables(
 }
 
 /// Build the `admin` connection for a governing entry: `custom_instance_user` for an instance
-/// database, on Windmill's cluster or the external one; the user's own resource for a BYO-postgres
-/// one.
+/// database, the user's own resource for a BYO-postgres one.
 async fn resolve_datatable_connection_unchecked(
     db: &DB,
     governing: &GoverningDatatable,
@@ -1705,16 +1691,7 @@ async fn resolve_datatable_connection_unchecked(
         .database
         .as_ref()
         .expect("a governing entry owns a database");
-    if database.resource_type == DataTableCatalogResourceType::ExternalInstance {
-        let pg_creds = crate::external_instance_pg::external_instance_connection_unchecked(
-            db,
-            &database.resource_path,
-            replication,
-        )
-        .await?;
-        serde_json::to_value(&pg_creds)
-            .map_err(|e| Error::internal_err(format!("Error serializing pg creds: {}", e)))
-    } else if database.resource_type == DataTableCatalogResourceType::Instance {
+    if database.resource_type == DataTableCatalogResourceType::Instance {
         let mut pg_creds = PgDatabase::parse_uri(&get_database_url().await?.as_str().await)?;
         pg_creds.dbname = database.resource_path.clone();
         if replication {
@@ -2258,10 +2235,6 @@ pub enum DucklakeCatalogResourceType {
     Postgresql,
     Mysql,
     Instance,
-    /// On the external instance cluster ([`crate::external_instance_pg`]). Enterprise Edition.
-    #[serde(rename = "external_instance")]
-    #[strum(serialize = "external_instance")]
-    ExternalInstance,
 }
 
 #[derive(Deserialize, Serialize)]
@@ -2789,16 +2762,7 @@ async fn ducklake_conn_data(
     let ducklake = serde_json::from_value::<Ducklake>(ducklake)?;
 
     let catalog_resource =
-        if ducklake.catalog.resource_type == DucklakeCatalogResourceType::ExternalInstance {
-            let pg_creds = crate::external_instance_pg::external_instance_connection_unchecked(
-                db,
-                &ducklake.catalog.resource_path,
-                false,
-            )
-            .await?;
-            serde_json::to_value(&pg_creds)
-                .map_err(|e| Error::internal_err(format!("Error serializing pg creds: {}", e)))?
-        } else if ducklake.catalog.resource_type == DucklakeCatalogResourceType::Instance {
+        if ducklake.catalog.resource_type == DucklakeCatalogResourceType::Instance {
             let mut pg_creds = PgDatabase::parse_uri(&get_database_url().await?.as_str().await)?;
             pg_creds.dbname = ducklake.catalog.resource_path.clone();
             pg_creds.user = Some("custom_instance_user".to_string());
@@ -3179,14 +3143,6 @@ async fn register_fork_ducklake_namespace(
     {
         return Ok(());
     }
-    let mut tx = db.begin().await?;
-    // A row naming an external database counts as a use of it. Written under the lock a drop takes,
-    // and only while the database is still registered, so a drop cannot slip in between the
-    // settings this attach resolved and the row that protects the database.
-    if let Some(dbname) = catalog.strip_prefix("external_instance:") {
-        crate::external_instance_pg::ensure_external_instance_database_registered(&mut tx, dbname)
-            .await?;
-    }
     sqlx::query!(
         "INSERT INTO fork_ducklake_namespace
            (workspace_id, ducklake_name, metadata_schema, catalog, storage, storage_ref, data_path)
@@ -3201,10 +3157,9 @@ async fn register_fork_ducklake_namespace(
         &storage_ref,
         data_path,
     )
-    .execute(&mut *tx)
+    .execute(db)
     .await
     .map_err(|e| Error::internal_err(format!("registering fork ducklake namespace: {e:#}")))?;
-    tx.commit().await?;
     let mut locations = FORK_DUCKLAKE_REGISTERED
         .get(w_id)
         .filter(|(_, exp)| *exp > now)

backend/windmill-worker/src/duckdb_executor.rs

@@ -2240,99 +2240,11 @@ fn parse_attach_db_resource<'a>(query: &'a str) -> Option<ParsedAttachDbResource
     None
 }
 
-/// The verification a DuckDB postgres attach keeps, as its libpq `sslmode` and `sslrootcert`.
-///
-/// Attaches have always turned verify-ca and verify-full into `require`, which resources rely on.
-/// A connection that explicitly refuses invalid certificates — the external instance cluster's —
-/// keeps its mode instead: under `require` its shared password would go to whichever server
-/// answers. DuckDB's libpq takes one root file, so it gets the system bundle plus the configured
-/// certificate.
-fn pg_attach_verification(res: &PgDatabase) -> Result<Option<(&str, std::path::PathBuf)>> {
-    let mode = match res.sslmode.as_deref() {
-        Some(mode @ ("verify-ca" | "verify-full")) if res.accept_invalid_certs == Some(false) => mode,
-        _ => return Ok(None),
-    };
-    let bundle = windmill_common::system_ca_bundle()
-        .map(std::fs::read_to_string)
-        .transpose()
-        .map_err(|e| Error::ExecutionErr(format!("Failed to read the system CA bundle: {e}")))?
-        .unwrap_or_default();
-    let pem = res.root_certificate_pem.as_deref().unwrap_or_default();
-    if bundle.is_empty() && pem.is_empty() {
-        return Err(Error::ExecutionErr(format!(
-            "sslmode {mode} needs a root certificate, and this worker has no system CA bundle"
-        )));
-    }
-    let roots = format!("{bundle}\n{pem}\n");
-    use sha2::Digest;
-    let dir = std::env::temp_dir().join("windmill-pg-roots");
-    let path = dir.join(format!(
-        "{}.pem",
-        hex::encode(&sha2::Sha256::digest(roots.as_bytes())[..8])
-    ));
-    let write_err = |e: std::io::Error| {
-        Error::ExecutionErr(format!("Failed to write root certificates: {e}"))
-    };
-    if path.is_file() {
-        // Marks it recently used, so pruning takes the others first.
-        let _ = std::fs::File::options()
-            .append(true)
-            .open(&path)
-            .and_then(|f| f.set_modified(std::time::SystemTime::now()));
-    } else {
-        std::fs::create_dir_all(&dir).map_err(write_err)?;
-        // Renamed into place: a job attaching concurrently must never read a half-written file.
-        let partial = path.with_extension(format!("{}.partial", Uuid::new_v4()));
-        std::fs::write(&partial, &roots)
-            .and_then(|()| std::fs::rename(&partial, &path))
-            .map_err(write_err)?;
-        prune_pg_roots(&dir, &path);
-    }
-    Ok(Some((mode, path)))
-}
-
-/// Root files outlive the job: a resource's certificate is workspace-controlled, so each distinct
-/// one would otherwise add a file forever. Keeps the most recently used ones.
-const PG_ROOTS_KEPT: usize = 32;
-
-fn prune_pg_roots(dir: &std::path::Path, keep: &std::path::Path) {
-    let Ok(entries) = std::fs::read_dir(dir) else {
-        return;
-    };
-    let mut files: Vec<(std::time::SystemTime, std::path::PathBuf)> = entries
-        .filter_map(|e| e.ok())
-        .map(|e| e.path())
-        .filter(|p| p.extension().is_some_and(|x| x == "pem") && p != keep)
-        .filter_map(|p| Some((std::fs::metadata(&p).ok()?.modified().ok()?, p)))
-        .collect();
-    if files.len() < PG_ROOTS_KEPT {
-        return;
-    }
-    files.sort();
-    for (_, p) in &files[..=files.len() - PG_ROOTS_KEPT] {
-        let _ = std::fs::remove_file(p);
-    }
-}
-
-fn pg_attach_uri(res: &PgDatabase) -> Result<String> {
-    let uri = res.to_uri();
-    let Some((mode, roots)) = pg_attach_verification(res)? else {
-        return Ok(uri);
-    };
-    let base = uri.strip_suffix("?sslmode=require").ok_or_else(|| {
-        Error::internal_err("unexpected sslmode in a postgres connection URI".to_string())
-    })?;
-    Ok(format!(
-        "{base}?sslmode={mode}&sslrootcert={}",
-        urlencoding::encode(&roots.to_string_lossy())
-    ))
-}
-
 fn format_attach_db_conn_str(db_resource: Value, db_type: &str) -> Result<String> {
     let s = match db_type.to_lowercase().as_str() {
         "postgres" | "postgresql" => {
             let res: PgDatabase = serde_json::from_value(db_resource)?;
-            pg_attach_uri(&res)?
+            res.to_uri()
         }
         #[cfg(feature = "mysql")]
         "mysql" => {
@@ -2479,9 +2391,7 @@ async fn transform_attach_ducklake(
         format!(", {}", user_extra_args)
     };
     let db_type = match ducklake.catalog.resource_type {
-        DucklakeCatalogResourceType::Instance | DucklakeCatalogResourceType::ExternalInstance => {
-            "postgres"
-        }
+        DucklakeCatalogResourceType::Instance => "postgres",
         _ => ducklake.catalog.resource_type.as_ref(),
     };
 
@@ -2597,8 +2507,7 @@ fn fork_defer_statements(
             hidden_passwords.lock().unwrap().push(pwd.to_string());
         }
         let db_type = match a.catalog.resource_type {
-            DucklakeCatalogResourceType::Instance
-            | DucklakeCatalogResourceType::ExternalInstance => "postgres",
+            DucklakeCatalogResourceType::Instance => "postgres",
             _ => a.catalog.resource_type.as_ref(),
         };
         stmts.push(get_attach_db_install_str(db_type)?.to_string());
@@ -2791,21 +2700,10 @@ fn pg_secret_attach_statements(db_resource: Value, alias_name: &str) -> Result<V
     let esc = |s: &str| s.replace('\'', "''");
     // The postgres secret type has no sslmode parameter, so it goes in the ATTACH
     // string; only the libpq values PgDatabase::to_uri collapses to are forwarded.
-    let sslmode = match pg_attach_verification(&res)? {
-        // A libpq keyword/value string: the path is quoted for libpq, then for the DuckDB literal.
-        Some((mode, roots)) => format!(
-            "{mode} sslrootcert=''{}''",
-            roots
-                .to_string_lossy()
-                .replace('\\', "\\\\")
-                .replace('\'', "\\''")
-        ),
-        None => match res.sslmode.as_deref() {
-            Some("disable") => "disable",
-            Some("require") | Some("verify-ca") | Some("verify-full") => "require",
-            _ => "prefer",
-        }
-        .to_string(),
+    let sslmode = match res.sslmode.as_deref() {
+        Some("disable") => "disable",
+        Some("require") | Some("verify-ca") | Some("verify-full") => "require",
+        _ => "prefer",
     };
     let secret_name = datatable_secret_name(alias_name);
     Ok(vec![
@@ -2898,46 +2796,6 @@ pub struct Arg {
 mod tests {
     use super::*;
 
-    #[test]
-    fn pg_attach_keeps_verification_only_when_required() {
-        let pg = |sslmode: &str, accept_invalid_certs: Option<bool>| PgDatabase {
-            host: "db.internal".to_string(),
-            user: Some("custom_instance_user".to_string()),
-            password: Some("pw".to_string()),
-            port: None,
-            sslmode: Some(sslmode.to_string()),
-            dbname: "dt".to_string(),
-            root_certificate_pem: Some("-----BEGIN CERTIFICATE-----test".to_string()),
-            accept_invalid_certs,
-            use_iam_auth: None,
-            region: None,
-        };
-        let uri = pg_attach_uri(&pg("verify-full", Some(false))).unwrap();
-        assert!(uri.contains("?sslmode=verify-full&sslrootcert="), "{uri}");
-        let root = urlencoding::decode(uri.split("sslrootcert=").nth(1).unwrap()).unwrap();
-        let roots = std::fs::read_to_string(root.as_ref()).unwrap();
-        for i in 0..(PG_ROOTS_KEPT + 5) {
-            let mut other = pg("verify-full", Some(false));
-            other.root_certificate_pem = Some(format!("-----BEGIN CERTIFICATE-----{i}"));
-            pg_attach_uri(&other).unwrap();
-        }
-        let kept = std::fs::read_dir(std::env::temp_dir().join("windmill-pg-roots"))
-            .unwrap()
-            .filter(|e| e.as_ref().unwrap().path().extension().is_some_and(|x| x == "pem"))
-            .count();
-        assert!(kept <= PG_ROOTS_KEPT, "{kept} root files kept");
-        assert!(roots.contains("-----BEGIN CERTIFICATE-----test"));
-        let external = serde_json::to_value(pg("verify-full", Some(false))).unwrap();
-        let attach = &pg_secret_attach_statements(external, "dt").unwrap()[3];
-        assert!(
-            attach.starts_with(&format!("ATTACH 'sslmode=verify-full sslrootcert=''{}''", root)),
-            "{attach}"
-        );
-        // A resource that never opted in keeps the historical downgrade.
-        assert!(pg_attach_uri(&pg("verify-full", None)).unwrap().ends_with("?sslmode=require"));
-        assert!(pg_attach_uri(&pg("require", Some(false))).unwrap().ends_with("?sslmode=require"));
-    }
-
     #[test]
     fn attach_datatable_parses_name_and_role() {
         let reference_of = |q: &str| parse_attach_datatable(q).unwrap().reference;

cli/src/commands/datatable/datatable.ts

@@ -111,8 +111,6 @@ const migrateCommand = new Command()
   )
   .action(migrateDown as any);
 
-type DataTableResourceType = "postgresql" | "instance" | "external_instance";
-
 async function create(
   opts: GlobalOptions & { resource?: string; force?: boolean },
   name?: string,
@@ -141,12 +139,12 @@ async function create(
 
   const datatables: Record<
     string,
-    { database: { resource_type: DataTableResourceType; resource_path?: string } }
+    { database: { resource_type: "postgresql" | "instance"; resource_path?: string } }
   > = {};
   for (const d of existing) {
     datatables[d.name] = {
       database: {
-        resource_type: d.resource_type as DataTableResourceType,
+        resource_type: d.resource_type as "postgresql" | "instance",
         resource_path: d.resource_path ?? undefined,
       },
     };

frontend/src/lib/components/InstanceSetting.svelte

@@ -27,7 +27,6 @@
 	import WebhookBaseUrlSetting from './instanceSettings/WebhookBaseUrlSetting.svelte'
 	import WsConnectivityTest from './instanceSettings/WsConnectivityTest.svelte'
 	import InstanceBannerSetting from './instanceSettings/InstanceBannerSetting.svelte'
-	import ExternalInstancePgSettings from './instanceSettings/ExternalInstancePgSettings.svelte'
 	import IndexerMemorySettings from './instanceSettings/IndexerMemorySettings.svelte'
 	import IndexerJobIndexSettings from './instanceSettings/IndexerJobIndexSettings.svelte'
 	import IndexerLogIndexSettings from './instanceSettings/IndexerLogIndexSettings.svelte'
@@ -782,10 +781,10 @@
 								/>
 								<p class="text-xs text-tertiary">
 									Comma-separated host/IP patterns the proxy still traces but for which it skips
-									upstream TLS certificate verification. Use for internal endpoints with self-signed
-									or otherwise untrusted certificates — unlike NO_PROXY above, these requests stay
-									traced. Same matching as NO_PROXY (<code>example.com</code> matches subdomains;
-									<code>.example.com</code> matches subdomains only).
+									upstream TLS certificate verification. Use for internal endpoints with
+									self-signed or otherwise untrusted certificates — unlike NO_PROXY above, these
+									requests stay traced. Same matching as NO_PROXY (<code>example.com</code> matches
+									subdomains; <code>.example.com</code> matches subdomains only).
 								</p>
 							</div>
 							<div class="flex flex-col gap-1">
@@ -873,8 +872,6 @@
 					<WsConnectivityTest {values} />
 				{:else if setting.fieldType == 'instance_banner'}
 					<InstanceBannerSetting {values} disabled={loading} />
-				{:else if setting.fieldType == 'external_instance_pg'}
-					<ExternalInstancePgSettings {values} disabled={loading} />
 				{/if}
 				{#if hasError}
 					<span class="text-red-600 dark:text-red-400 text-xs">

frontend/src/lib/components/InstanceSettings.svelte

@@ -730,7 +730,6 @@
 		secret_backend: ['token'],
 		object_store_cache_config: ['secret_key', 'serviceAccountKey'],
 		custom_instance_pg_databases: ['user_pwd'],
-		external_instance_pg: ['password'],
 		rsa_keys: ['private_key'],
 		github_enterprise_app: ['private_key']
 	}
@@ -1235,11 +1234,6 @@
 				description="Configure a self-managed GitHub App for git sync on GitHub.com, GHE Cloud or GitHub Enterprise Server."
 				link="https://www.windmill.dev/docs/integrations/git_repository#self-managed-github-app"
 			/>
-		{:else if category == 'External Postgres'}
-			<SettingsPageHeader
-				title="External Postgres"
-				description="Store data tables and Ducklake catalogs on a PostgreSQL cluster outside Windmill's own database. Save the connection, set the cluster up, then create databases for workspaces to use."
-			/>
 		{:else if category == 'DB Health'}
 			<SettingsPageHeader
 				title="DB Health"

frontend/src/lib/components/SaveButton.svelte

@@ -49,11 +49,7 @@
 			})
 			.catch((error) => {
 				console.error('Save failed:', error)
-				// An ApiError's message is only the HTTP status text; the server's reason is its body.
-				sendUserToast(
-					(typeof error?.body === 'string' && error.body) || error?.message || 'Save failed',
-					true
-				)
+				sendUserToast(error?.message ?? 'Save failed', true)
 				saveStatus = 'error'
 				statusTimeout = setTimeout(() => {
 					saveStatus = null

frontend/src/lib/components/instanceSettings.ts

@@ -71,7 +71,6 @@ export interface Setting {
 		| 'ws_connectivity'
 		| 'retention_overrides'
 		| 'instance_banner'
-		| 'external_instance_pg'
 	storage: SettingStorage
 	advancedToggle?: {
 		label: string
@@ -719,17 +718,6 @@ export const settings: Record<string, Setting[]> = {
 		}
 	],
 	'DB Health': [],
-	'External Postgres': [
-		{
-			label: 'External instance cluster',
-			description:
-				'A PostgreSQL cluster Windmill administers for data tables and Ducklake catalogs of the External instance type. The admin user needs CREATEDB and CREATEROLE, plus REPLICATION for Postgres triggers. Windmill creates its own roles and databases there and leaves everything else on the cluster alone.',
-			key: 'external_instance_pg',
-			fieldType: 'external_instance_pg',
-			storage: 'setting',
-			ee_only: 'External instance databases are an Enterprise Edition feature'
-		}
-	],
 	Registries: [
 		{
 			label: 'Instance Python Version',
@@ -1253,14 +1241,6 @@ export const instanceSettingsNavigationGroups = [
 				aiId: 'instance-settings-object-storage',
 				aiDescription: 'Instance object storage settings',
 				isEE: true
-			},
-			{
-				id: 'external_postgres',
-				label: 'External Postgres',
-				aiId: 'instance-settings-external-postgres',
-				aiDescription:
-					'External PostgreSQL cluster Windmill manages for external instance data tables and Ducklake catalogs',
-				isEE: true
 			}
 		]
 	},
@@ -1385,7 +1365,6 @@ export const tabToCategoryMap: Record<string, string> = {
 	github_enterprise_app: 'GitHub App',
 	websocket: 'WebSocket',
 	db_health: 'DB Health',
-	external_postgres: 'External Postgres',
 	lsp: 'LSP'
 }
 
@@ -1422,7 +1401,6 @@ export const categoryToTabMap: Record<string, string> = {
 	'GitHub App': 'github_enterprise_app',
 	WebSocket: 'websocket',
 	'DB Health': 'db_health',
-	'External Postgres': 'external_postgres',
 	LSP: 'lsp'
 }
 

frontend/src/lib/components/instanceSettings/ExternalInstancePgSettings.svelte

@@ -1,400 +0,0 @@
-<script lang="ts">
-	import { Alert, Button } from '$lib/components/common'
-	import TextInput from '../text_input/TextInput.svelte'
-	import Password from '../Password.svelte'
-	import Select from '../select/Select.svelte'
-	import DataTable from '../table/DataTable.svelte'
-	import Head from '../table/Head.svelte'
-	import Row from '../table/Row.svelte'
-	import Cell from '../table/Cell.svelte'
-	import ConfirmationModal from '../common/confirmationModal/ConfirmationModal.svelte'
-	import { createAsyncConfirmationModal } from '../common/confirmationModal/asyncConfirmationModal.svelte'
-	import {
-		SettingService,
-		type CustomInstanceDbTag,
-		type ExternalInstancePgSetupReport
-	} from '$lib/gen'
-	import { instanceSettingsSaved } from '../instanceSettings'
-	import { enterpriseLicense } from '$lib/stores'
-	import { sendUserToast } from '$lib/toast'
-	import { resource } from 'runed'
-	import { deepEqual } from 'fast-equals'
-	import {
-		CircleCheck,
-		CircleX,
-		KeyRound,
-		Plus,
-		Trash2,
-		TriangleAlert,
-		Wrench
-	} from 'lucide-svelte'
-	import type { Writable } from 'svelte/store'
-
-	interface Props {
-		values: Writable<Record<string, any>>
-		disabled?: boolean
-	}
-
-	let { values, disabled = false }: Props = $props()
-
-	const KEY = 'external_instance_pg'
-	const SSLMODES = ['verify-full', 'verify-ca', 'require', 'prefer', 'disable']
-
-	let isDisabled = $derived(disabled || !$enterpriseLicense)
-
-	function field(key: string): any {
-		return $values[KEY]?.[key]
-	}
-
-	// Empty inputs are removed rather than sent: the backend reads every field as optional, and an
-	// empty string would be a real (and invalid) host, port or sslmode.
-	function setField(key: string, value: any) {
-		const next = { ...($values[KEY] ?? {}) }
-		if (value === '' || value === undefined || value === null) {
-			delete next[key]
-		} else {
-			next[key] = key === 'port' ? Number(value) : value
-		}
-		$values[KEY] = Object.keys(next).length > 0 ? next : undefined
-	}
-
-	// Setup reads the saved settings, never the form, so it waits until the form is saved.
-	const saved = resource(
-		() => $instanceSettingsSaved,
-		async () => {
-			try {
-				return (await SettingService.getGlobal({ key: KEY })) ?? undefined
-			} catch {
-				return undefined
-			}
-		}
-	)
-	let unsaved = $derived(!saved.loading && !deepEqual(saved.current ?? undefined, $values[KEY]))
-
-	let refreshKey = $state(0)
-	const status = resource(
-		() => [$instanceSettingsSaved, refreshKey],
-		async () => {
-			try {
-				return await SettingService.getExternalInstancePgStatus()
-			} catch {
-				return undefined
-			}
-		}
-	)
-	const databases = resource(
-		() => [$instanceSettingsSaved, refreshKey],
-		async () => {
-			try {
-				return await SettingService.listExternalInstancePgDatabases()
-			} catch {
-				return {}
-			}
-		}
-	)
-
-	let freshReport: ExternalInstancePgSetupReport | undefined = $state(undefined)
-	let report = $derived(freshReport ?? status.current?.last_setup)
-	let runningSetup: 'setup' | 'rotate' | undefined = $state(undefined)
-
-	const confirmationModal = createAsyncConfirmationModal()
-
-	async function runSetup(rotate: boolean) {
-		if (rotate) {
-			const ok = await confirmationModal.ask({
-				title: 'Rotate passwords',
-				children:
-					'Windmill generates new passwords for its two roles on the external cluster. Jobs that connect afterwards use the new ones.',
-				confirmationText: 'Rotate'
-			})
-			if (!ok) return
-		}
-		runningSetup = rotate ? 'rotate' : 'setup'
-		try {
-			freshReport = await SettingService.setupExternalInstancePg({
-				requestBody: { rotate_passwords: rotate }
-			})
-			sendUserToast(
-				freshReport.success ? 'External cluster is set up' : 'Setup failed, see the report below',
-				!freshReport.success
-			)
-		} catch (e) {
-			sendUserToast(e?.body ?? e?.message ?? String(e), true)
-		} finally {
-			runningSetup = undefined
-			refreshKey++
-		}
-	}
-
-	let newDbName = $state('')
-	let newDbTag: CustomInstanceDbTag = $state('datatable')
-	let creating = $state(false)
-
-	async function createDatabase() {
-		creating = true
-		try {
-			await SettingService.createExternalInstancePgDatabase({
-				name: newDbName.trim(),
-				requestBody: { tag: newDbTag }
-			})
-			sendUserToast(`Created database ${newDbName.trim()}`)
-			newDbName = ''
-		} catch (e) {
-			sendUserToast(e?.body ?? e?.message ?? String(e), true)
-		} finally {
-			creating = false
-			refreshKey++
-		}
-	}
-
-	async function dropDatabase(name: string) {
-		const ok = await confirmationModal.ask({
-			title: `Drop database ${name}`,
-			children:
-				'The database and everything in it is deleted from the external cluster. This cannot be undone.',
-			confirmationText: 'Drop database'
-		})
-		if (!ok) return
-		try {
-			await SettingService.dropExternalInstancePgDatabase({ name })
-			sendUserToast(`Dropped database ${name}`)
-		} catch (e) {
-			sendUserToast(e?.body ?? e?.message ?? String(e), true)
-		} finally {
-			refreshKey++
-		}
-	}
-
-	let databaseEntries = $derived(Object.entries(databases.current ?? {}))
-	let setUp = $derived(!!status.current?.last_setup?.success)
-</script>
-
-<div class="flex flex-col gap-6">
-	{#if !$enterpriseLicense}
-		<Alert
-			type="info"
-			title="External instance databases are an Enterprise Edition feature"
-			size="xs"
-		/>
-	{/if}
-
-	<div class="grid grid-cols-2 gap-x-2 gap-y-4">
-		<div class="flex flex-col gap-1">
-			<label for="external_pg_host" class="text-xs font-semibold text-emphasis">Host</label>
-			<TextInput
-				inputProps={{ id: 'external_pg_host', placeholder: 'db.example.com', disabled: isDisabled }}
-				bind:value={() => field('host'), (v) => setField('host', v)}
-			/>
-		</div>
-		<div class="flex flex-col gap-1">
-			<label for="external_pg_port" class="text-xs font-semibold text-emphasis">Port</label>
-			<TextInput
-				inputProps={{
-					id: 'external_pg_port',
-					type: 'number',
-					placeholder: '5432',
-					disabled: isDisabled
-				}}
-				bind:value={() => field('port'), (v) => setField('port', v)}
-			/>
-		</div>
-		<div class="flex flex-col gap-1">
-			<label for="external_pg_user" class="text-xs font-semibold text-emphasis">Admin user</label>
-			<TextInput
-				inputProps={{ id: 'external_pg_user', placeholder: 'windmill_admin', disabled: isDisabled }}
-				bind:value={() => field('user'), (v) => setField('user', v)}
-			/>
-		</div>
-		<div class="flex flex-col gap-1">
-			<label for="external_pg_password" class="text-xs font-semibold text-emphasis">Password</label>
-			<Password
-				id="external_pg_password"
-				small
-				disabled={isDisabled}
-				bind:password={() => field('password'), (v) => setField('password', v)}
-			/>
-		</div>
-		<div class="flex flex-col gap-1">
-			<label for="external_pg_dbname" class="text-xs font-semibold text-emphasis">
-				Maintenance database
-			</label>
-			<TextInput
-				inputProps={{ id: 'external_pg_dbname', placeholder: 'postgres', disabled: isDisabled }}
-				bind:value={() => field('dbname'), (v) => setField('dbname', v)}
-			/>
-		</div>
-		<div class="flex flex-col gap-1">
-			<label for="external_pg_sslmode" class="text-xs font-semibold text-emphasis">SSL mode</label>
-			<Select
-				id="external_pg_sslmode"
-				items={SSLMODES.map((m) => ({ value: m, label: m }))}
-				placeholder="verify-full (default)"
-				clearable
-				disabled={isDisabled}
-				bind:value={() => field('sslmode'), (v) => setField('sslmode', v)}
-			/>
-		</div>
-		<div class="col-span-2 flex flex-col gap-1">
-			<label for="external_pg_root_cert" class="text-xs font-semibold text-emphasis">
-				Root certificate (PEM)
-			</label>
-			<TextInput
-				underlyingInputEl="textarea"
-				inputProps={{
-					id: 'external_pg_root_cert',
-					placeholder: '-----BEGIN CERTIFICATE-----',
-					rows: 3,
-					disabled: isDisabled
-				}}
-				bind:value={() => field('root_certificate_pem'), (v) => setField('root_certificate_pem', v)}
-			/>
-			<span class="text-2xs text-secondary">
-				Leave empty to verify against the system trust store.
-			</span>
-		</div>
-	</div>
-
-	<div class="flex flex-col gap-2">
-		<div class="flex items-center gap-2">
-			<Button
-				unifiedSize="md"
-				variant="accent"
-				startIcon={{ icon: Wrench }}
-				disabled={isDisabled || unsaved || !saved.current || !!runningSetup}
-				loading={runningSetup === 'setup'}
-				onclick={() => runSetup(false)}
-			>
-				Set up cluster
-			</Button>
-			<Button
-				unifiedSize="md"
-				variant="default"
-				startIcon={{ icon: KeyRound }}
-				disabled={isDisabled || unsaved || !saved.current || !setUp || !!runningSetup}
-				loading={runningSetup === 'rotate'}
-				onclick={() => runSetup(true)}
-			>
-				Rotate passwords
-			</Button>
-			{#if unsaved}
-				<span class="text-xs text-secondary">Save the settings before setting the cluster up.</span>
-			{:else if !saved.current}
-				<span class="text-xs text-secondary">Fill in the connection and save to set it up.</span>
-			{/if}
-		</div>
-
-		{#if report}
-			<div class="flex flex-col gap-1 rounded-md border p-3 bg-surface-secondary">
-				<div class="flex items-center justify-between text-xs">
-					<span class="font-semibold text-emphasis">
-						{report.success ? 'Last setup succeeded' : 'Last setup failed'}
-					</span>
-					<span class="text-secondary">{new Date(report.finished_at).toLocaleString()}</span>
-				</div>
-				<ul class="flex flex-col gap-1.5 mt-1">
-					{#each report.steps as step, i (i)}
-						<li class="flex gap-2 text-xs">
-							{#if step.status === 'ok'}
-								<CircleCheck size={14} class="text-green-600 dark:text-green-400 shrink-0 mt-0.5" />
-							{:else if step.status === 'warning'}
-								<TriangleAlert
-									size={14}
-									class="text-yellow-600 dark:text-yellow-400 shrink-0 mt-0.5"
-								/>
-							{:else}
-								<CircleX size={14} class="text-red-600 dark:text-red-400 shrink-0 mt-0.5" />
-							{/if}
-							<span class="font-mono text-secondary shrink-0">{step.name}</span>
-							<span class="text-primary break-words">{step.message}</span>
-						</li>
-					{/each}
-				</ul>
-			</div>
-		{/if}
-	</div>
-
-	<div class="flex flex-col gap-2">
-		<div class="flex flex-col gap-0.5">
-			<span class="text-xs font-semibold text-emphasis">Databases</span>
-			<span class="text-xs text-secondary">
-				Databases Windmill created on this cluster. Workspaces use them by picking the
-				<span class="font-semibold">External instance</span> type in their data table or Ducklake settings.
-			</span>
-		</div>
-		<DataTable>
-			<Head>
-				<tr>
-					<Cell head first>Name</Cell>
-					<Cell head>Used for</Cell>
-					<Cell head>Used by</Cell>
-					<Cell head last></Cell>
-				</tr>
-			</Head>
-			<tbody class="divide-y bg-surface-tertiary">
-				{#if databaseEntries.length === 0}
-					<Row>
-						<Cell colspan={4} class="text-center text-xs text-secondary py-4">No database yet</Cell>
-					</Row>
-				{/if}
-				{#each databaseEntries as [name, db] (name)}
-					<Row>
-						<Cell first class="font-mono text-xs">{name}</Cell>
-						<Cell class="text-xs">{db.tag === 'ducklake' ? 'Ducklake' : 'Data table'}</Cell>
-						<Cell class="text-xs">
-							{(db.used_by_workspaces ?? []).join(', ') || '—'}
-						</Cell>
-						<Cell last class="text-right">
-							<Button
-								unifiedSize="sm"
-								variant="subtle"
-								startIcon={{ icon: Trash2 }}
-								iconOnly
-								disabled={isDisabled || (db.used_by_workspaces ?? []).length > 0}
-								title={(db.used_by_workspaces ?? []).length > 0
-									? 'Still used by a workspace'
-									: `Drop ${name}`}
-								onclick={() => dropDatabase(name)}
-							/>
-						</Cell>
-					</Row>
-				{/each}
-			</tbody>
-		</DataTable>
-		<div class="flex items-center gap-2">
-			<TextInput
-				class="flex-1"
-				inputProps={{
-					id: 'external_pg_new_db',
-					placeholder: 'New database name',
-					disabled: isDisabled || !setUp
-				}}
-				bind:value={newDbName}
-			/>
-			<Select
-				id="external_pg_new_db_tag"
-				class="w-36"
-				items={[
-					{ value: 'datatable', label: 'Data table' },
-					{ value: 'ducklake', label: 'Ducklake' }
-				]}
-				disabled={isDisabled || !setUp}
-				bind:value={newDbTag}
-			/>
-			<Button
-				unifiedSize="md"
-				variant="default"
-				startIcon={{ icon: Plus }}
-				disabled={isDisabled || !setUp || !newDbName.trim() || creating}
-				loading={creating}
-				onclick={createDatabase}
-			>
-				Create database
-			</Button>
-		</div>
-		{#if !setUp}
-			<span class="text-xs text-secondary">Set the cluster up before creating databases.</span>
-		{/if}
-	</div>
-</div>
-
-<ConfirmationModal {...confirmationModal.props} />

frontend/src/lib/components/workspaceSettings/DataTablePermissionsButton.svelte

@@ -78,9 +78,6 @@
 	const unusedRoles = $derived(availableRoles.filter((r) => !roles.some((row) => row.id === r.id)))
 	const pendingRoles = $derived(roles.filter((r) => r.id === undefined))
 	let instanceRoles: InstanceRolesButton | undefined = $state(undefined)
-	const clusterLabel = $derived(
-		info?.cluster === 'external_instance' ? 'the external instance' : 'this instance'
-	)
 
 	const roleKey = (role: EditedRole) => role.id ?? `pending:${role.name}`
 
@@ -177,7 +174,7 @@
 	async function refreshCatalog() {
 		let fresh: InstanceDatatableRole[]
 		try {
-			fresh = await SettingService.listInstanceDatatableRoles({ cluster: info?.cluster })
+			fresh = await SettingService.listInstanceDatatableRoles()
 		} catch (e) {
 			sendUserToast(e?.body ?? e?.message ?? String(e), true)
 			return
@@ -234,7 +231,7 @@
 	<DrawerContent
 		title="Roles — {datatable}"
 		on:close={() => (drawerOpen = false)}
-		tooltip="A data table role is a Postgres login. A job that names one connects as it, and Postgres decides what it may touch — grant it privileges under Access. Roles are defined once per cluster, for every data table on it; here you say who may use each one on this data table."
+		tooltip="A data table role is a Postgres login. A job that names one connects as it, and Postgres decides what it may touch — grant it privileges under Access. Roles are defined for the whole instance; here you say who may use each one on this data table."
 	>
 		{#snippet titleExtra()}
 			<Badge color="blue" small>Beta</Badge>
@@ -257,9 +254,9 @@
 
 				{#if !info?.supported}
 					<Alert type="info" title="Not available on this data table" size="xs">
-						A data table role is a Postgres login on a cluster Windmill manages, so only a data table
-						on the Windmill instance or the external instance can use one. This one is backed by a
-						PostgreSQL resource — grant access on that server directly.
+						A data table role is a Postgres login on the Windmill instance's own database, so only a
+						data table backed by that database can use one. This one is backed by a PostgreSQL
+						resource — grant access on that server directly.
 					</Alert>
 				{:else if governing}
 					<Alert type="info" title="Governed by {governing}" size="xs">
@@ -286,7 +283,7 @@
 
 				{#if permissioned}
 					{#if editable && availableRoles.length === 0}
-						<Alert type="warning" title="No role defined on {clusterLabel}" size="xs">
+						<Alert type="warning" title="No role defined on this instance" size="xs">
 							Only <span class="font-mono">admin</span> can be used until a superadmin creates a data
 							table role. Type a name below to add one.
 						</Alert>
@@ -300,7 +297,7 @@
 									<Tooltip>
 										admin is the connection the data table used before roles, so it owns every
 										existing object and cannot be removed. Every other role is a login defined for
-										the whole cluster, with only the privileges granted to it under Access.
+										the whole instance, with only the privileges granted to it under Access.
 									</Tooltip>
 								</Cell>
 								<Cell head>
@@ -329,23 +326,23 @@
 											<span class="font-mono text-xs text-emphasis">{role.name ?? role.id}</span>
 											{#if !role.name}
 												<span class="text-2xs text-secondary italic">
-													no longer defined on {clusterLabel}
+													no longer defined on this instance
 												</span>
 											{:else if role.id === undefined}
 												<Alert type="warning" title="This role does not exist yet" size="xs">
 													{#if $superadmin}
 														<div class="flex flex-col items-start gap-1">
-															<span>Create it on {clusterLabel} to use it here.</span>
+															<span>Create it on the instance to use it here.</span>
 															<Button
 																unifiedSize="xs"
 																variant="default"
-																on:click={() => instanceRoles?.open(role.name, info?.cluster)}
+																on:click={() => instanceRoles?.open(role.name)}
 															>
 																Create it
 															</Button>
 														</div>
 													{:else}
-														Only a superadmin can create it on {clusterLabel}.
+														Only a superadmin can create it on the instance.
 													{/if}
 												</Alert>
 											{/if}

frontend/src/lib/components/workspaceSettings/DataTableRolesSection.svelte

@@ -10,16 +10,13 @@
 	import Head from '../table/Head.svelte'
 	import Row from '../table/Row.svelte'
 	import { Pencil, Plus } from 'lucide-svelte'
-	import { SettingService, type DatatableRoleCluster, type InstanceDatatableRole } from '$lib/gen'
+	import { SettingService, type InstanceDatatableRole } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
 
 	let {
-		cluster = 'instance',
 		initialName = '',
 		onChanged
 	}: {
-		/** The cluster whose role catalog is shown. Fixed for the component's lifetime. */
-		cluster?: DatatableRoleCluster
 		/** Prefills the name of the role to add. */
 		initialName?: string
 		/** Called after every change to the catalog, whether or not it went through. */
@@ -41,7 +38,7 @@
 		loading = true
 		loadError = undefined
 		try {
-			roles = await SettingService.listInstanceDatatableRoles({ cluster })
+			roles = await SettingService.listInstanceDatatableRoles()
 		} catch (e) {
 			loadError = e?.body ?? e?.message ?? String(e)
 		} finally {
@@ -72,7 +69,7 @@
 		await run(
 			() =>
 				SettingService.createInstanceDatatableRole({
-					requestBody: { name, cluster }
+					requestBody: { name }
 				}),
 			`Created the data table role ${name}`
 		)
@@ -83,7 +80,7 @@
 		const confirmed = await confirmationModal.ask({
 			title: `Delete the role ${role.name}?`,
 			children:
-				'Everything it owns in every database of its cluster is handed back to the admin connection, its grants are dropped, and it is removed from every data table that named it. This cannot be undone.',
+				'Everything it owns in every instance database is handed back to the admin connection, its grants are dropped, and it is removed from every data table that named it. This cannot be undone.',
 			confirmationText: 'Delete role'
 		})
 		if (!confirmed) return
@@ -98,7 +95,7 @@
 
 <div class="flex flex-col gap-2">
 	{#if loadError}
-		<Alert type="error" title="Could not load the data table roles" size="xs">{loadError}</Alert>
+		<Alert type="error" title="Could not load the instance roles" size="xs">{loadError}</Alert>
 	{:else}
 		<DataTable>
 			<Head>

frontend/src/lib/components/workspaceSettings/DataTableSettings.svelte

@@ -9,7 +9,7 @@
 			id: string
 			name: string
 			database: {
-				resource_type: 'postgresql' | 'instance' | 'external_instance'
+				resource_type: 'postgresql' | 'instance'
 				resource_path?: string | undefined
 			}
 			/** Set on a fork's entry: it names the workspace whose data table governs this one, and
@@ -81,10 +81,8 @@
 	import {
 		isCustomInstanceDbEnabled,
 		getUnusedInstanceDbName,
-		isDataTableWizardEnabled,
-		externalInstanceDbUnavailableReason
+		isDataTableWizardEnabled
 	} from './utils.svelte'
-	import ExternalInstanceDbSelect from './ExternalInstanceDbSelect.svelte'
 	import { random_adj } from '../random_positive_adjetive'
 	import { sendUserToast } from '$lib/toast'
 	import {
@@ -422,13 +420,6 @@
 									>
 										Use Windmill's PostgreSQL instance
 									</Tooltip>
-								{:else if dataTable.database.resource_type === 'external_instance'}
-									<Tooltip
-										wrapperClass="absolute mt-[0.6rem] right-2 z-20"
-										placement="bottom-start"
-									>
-										Use a database on the external PostgreSQL cluster set in instance settings
-									</Tooltip>
 								{/if}
 								<Select
 									items={[
@@ -442,12 +433,6 @@
 												: isCloudHosted()
 													? 'Not available on cloud'
 													: 'Superadmin only'
-										},
-										{
-											value: 'external_instance',
-											label: 'External instance',
-											disabled: !!$externalInstanceDbUnavailableReason,
-											subtitle: $externalInstanceDbUnavailableReason
 										}
 									]}
 									bind:value={
@@ -461,22 +446,16 @@
 										}
 									}
 									id="database-type-select"
-									class="w-40"
+									class="w-28"
 								/>
 							</div>
 							<div class="flex items-center gap-1 w-80 relative">
-								{#if dataTable.database.resource_type === 'postgresql'}
+								{#if dataTable.database.resource_type !== 'instance'}
 									<ResourcePicker
 										class="flex-1"
 										bind:value={dataTable.database.resource_path}
 										resourceType={dataTable.database.resource_type}
 									/>
-								{:else if dataTable.database.resource_type === 'external_instance'}
-									<ExternalInstanceDbSelect
-										class="flex-1"
-										bind:value={dataTable.database.resource_path}
-										tag="datatable"
-									/>
 								{:else}
 									<CustomInstanceDbSelect
 										class="flex-1"

frontend/src/lib/components/workspaceSettings/DucklakeSettings.svelte

@@ -13,7 +13,7 @@
 		ducklakes: {
 			name: string
 			catalog: {
-				resource_type: 'postgresql' | 'mysql' | 'instance' | 'external_instance'
+				resource_type: 'postgresql' | 'mysql' | 'instance'
 				resource_path?: string // Name of the database when resource_type is instance
 			}
 			storage: {
@@ -105,12 +105,7 @@
 	import Popover from '../meltComponents/Popover.svelte'
 	import TextInput from '../text_input/TextInput.svelte'
 	import { slide } from 'svelte/transition'
-	import {
-		isCustomInstanceDbEnabled,
-		getUnusedInstanceDbName,
-		externalInstanceDbUnavailableReason
-	} from './utils.svelte'
-	import ExternalInstanceDbSelect from './ExternalInstanceDbSelect.svelte'
+	import { isCustomInstanceDbEnabled, getUnusedInstanceDbName } from './utils.svelte'
 	import { resource } from 'runed'
 	import CustomInstanceDbSelect from './CustomInstanceDbSelect.svelte'
 	import Label from '../Label.svelte'
@@ -288,9 +283,10 @@
 			This workspace is a fork, and these settings are its own copy. Lakes marked
 			<span class="font-semibold">isolated</span> read the parent's tables through defer views and
 			write to a fork-scoped namespace that is cleaned up when the fork is deleted. Lakes marked
-			<span class="font-semibold">shared with parent</span> read and write the parent's physical lake
-			directly — editing their catalog or storage here repoints the shared lake for this fork's jobs.
-			The choice is made per lake when the fork is created and cannot be changed here.
+			<span class="font-semibold">shared with parent</span> read and write the parent's physical
+			lake directly — editing their catalog or storage here repoints the shared lake for this
+			fork's jobs. The choice is made per lake when the fork is created and cannot be changed
+			here.
 		</Alert>
 	</div>
 {/if}
@@ -363,8 +359,8 @@
 									isolated
 								</span>
 								<Tooltip>
-									Writes go to a fork-scoped namespace; reads of tables not yet materialized in this
-									fork defer to the parent. Deleting the fork cleans the namespace up.
+									Writes go to a fork-scoped namespace; reads of tables not yet materialized in
+									this fork defer to the parent. Deleting the fork cleans the namespace up.
 								</Tooltip>
 							{/if}
 						</div>
@@ -377,11 +373,6 @@
 								<Tooltip wrapperClass="absolute mt-[0.6rem] right-2 z-20" placement="bottom-start">
 									Use Windmill's PostgreSQL instance as a catalog
 								</Tooltip>
-							{:else if ducklake.catalog.resource_type === 'external_instance'}
-								<Tooltip wrapperClass="absolute mt-[0.6rem] right-2 z-20" placement="bottom-start">
-									Use a database on the external PostgreSQL cluster set in instance settings as a
-									catalog
-								</Tooltip>
 							{/if}
 							<Select
 								items={[
@@ -391,12 +382,6 @@
 										value: 'instance',
 										label: 'Instance',
 										subtitle: $isCustomInstanceDbEnabled ? undefined : 'Superadmin only'
-									},
-									{
-										value: 'external_instance',
-										label: 'External instance',
-										disabled: !!$externalInstanceDbUnavailableReason,
-										subtitle: $externalInstanceDbUnavailableReason
 									}
 								]}
 								bind:value={
@@ -409,22 +394,16 @@
 										}
 									}
 								}
-								class="w-40"
+								class="w-24"
 							/>
 						</div>
 						<div class="flex flex-1">
-							{#if ducklake.catalog.resource_type === 'postgresql' || ducklake.catalog.resource_type === 'mysql'}
+							{#if ducklake.catalog.resource_type !== 'instance'}
 								<ResourcePicker
 									class="flex-1 min-w-32"
 									bind:value={ducklake.catalog.resource_path}
 									resourceType={ducklake.catalog.resource_type}
 								/>
-							{:else if ducklake.catalog.resource_type === 'external_instance'}
-								<ExternalInstanceDbSelect
-									class="flex-1 min-w-32"
-									bind:value={ducklake.catalog.resource_path}
-									tag="ducklake"
-								/>
 							{:else}
 								<CustomInstanceDbSelect
 									class="flex-1 min-w-32"

frontend/src/lib/components/workspaceSettings/ExternalInstanceDbSelect.svelte

@@ -1,84 +0,0 @@
-<script lang="ts">
-	import { SettingService, type CustomInstanceDbTag } from '$lib/gen'
-	import { resource } from 'runed'
-	import Select from '../select/Select.svelte'
-	import { safeSelectItems } from '../select/utils.svelte'
-	import Button from '../common/button/Button.svelte'
-	import { sendUserToast } from '$lib/toast'
-	import { isExternalInstanceDbEnabled } from './utils.svelte'
-	import { Plus } from 'lucide-svelte'
-
-	type Props = {
-		value: string | undefined
-		tag: CustomInstanceDbTag
-		class?: string
-	}
-	let { value = $bindable(), tag, class: className }: Props = $props()
-
-	let refreshKey = $state(0)
-	const databases = resource(
-		() => refreshKey,
-		async () => {
-			try {
-				return await SettingService.listExternalInstancePgDatabases()
-			} catch {
-				return {}
-			}
-		}
-	)
-
-	// Every database Windmill created is offered, whatever it was created for: the tag only
-	// sorts the ones made for this kind of storage first.
-	let items = $derived(
-		safeSelectItems(
-			Object.entries(databases.current ?? {})
-				.sort(([, a], [, b]) => Number(b.tag === tag) - Number(a.tag === tag))
-				.map(([name]) => name)
-		)
-	)
-	let exists = $derived(!!value && !!databases.current?.[value])
-	let creating = $state(false)
-
-	async function create() {
-		if (!value) return
-		creating = true
-		try {
-			await SettingService.createExternalInstancePgDatabase({
-				name: value,
-				requestBody: { tag }
-			})
-			sendUserToast(`Created database ${value} on the external cluster`)
-		} catch (e) {
-			sendUserToast(e?.body ?? e?.message ?? String(e), true)
-		} finally {
-			creating = false
-			refreshKey++
-		}
-	}
-</script>
-
-<div class="flex items-center gap-1 {className}">
-	<Select
-		class="flex-1"
-		bind:value
-		onCreateItem={(i) => (value = i)}
-		placeholder="Search or create..."
-		showPlaceholderOnOpen
-		{items}
-		id="external-instance-db-select"
-		disabled={!$isExternalInstanceDbEnabled}
-	/>
-	{#if value && !databases.loading && !exists}
-		<Button
-			unifiedSize="sm"
-			variant="default"
-			startIcon={{ icon: Plus }}
-			loading={creating}
-			disabled={!$isExternalInstanceDbEnabled}
-			title="Create this database on the external cluster"
-			onclick={create}
-		>
-			Create
-		</Button>
-	{/if}
-</div>

frontend/src/lib/components/workspaceSettings/InstanceRolesButton.svelte

@@ -1,9 +1,6 @@
 <script lang="ts">
 	import { Badge, Button, Drawer, DrawerContent } from '../common'
-	import ToggleButtonGroup from '../common/toggleButton-v2/ToggleButtonGroup.svelte'
-	import ToggleButton from '../common/toggleButton-v2/ToggleButton.svelte'
 	import { Users } from 'lucide-svelte'
-	import { SettingService, type DatatableRoleCluster } from '$lib/gen'
 	import DataTableRolesSection from './DataTableRolesSection.svelte'
 
 	let {
@@ -18,20 +15,14 @@
 
 	let drawer: Drawer | undefined = $state(undefined)
 	let prefill = $state('')
-	let cluster = $state<DatatableRoleCluster>('instance')
-	let externalConfigured = $state(false)
 	// Remounts the section on each open, so the prefilled name is the one just asked for.
 	let openCount = $state(0)
 
-	/** Opens the drawer on `targetCluster`'s catalog, with `name` prefilled as the role to add. */
-	export function open(name = '', targetCluster: DatatableRoleCluster = 'instance') {
+	/** Opens the drawer, with `name` prefilled as the role to add. */
+	export function open(name = '') {
 		prefill = name
-		cluster = targetCluster
 		openCount++
 		drawer?.openDrawer()
-		SettingService.getExternalInstancePgStatus()
-			.then((s) => (externalConfigured = s.configured))
-			.catch(() => (externalConfigured = false))
 	}
 </script>
 
@@ -45,30 +36,13 @@
 	<DrawerContent
 		title="Instance roles"
 		on:close={() => drawer?.closeDrawer()}
-		tooltip="A data table role is a real Postgres login on one cluster Windmill manages: this instance's own, shared by every instance database, or the external instance cluster, shared by every external instance database. A job that names one connects as it, and Postgres decides what it may touch. Which people may use a role on a given data table, and what it may do there, is set per data table, in its roles drawer."
+		tooltip="A data table role is a real Postgres login on this instance, shared by every instance database. A job that names one connects as it, and Postgres decides what it may touch. Which people may use a role on a given data table, and what it may do there, is set per data table, in its roles drawer."
 	>
 		{#snippet titleExtra()}
 			<Badge color="blue" small>Beta</Badge>
 		{/snippet}
-		<div class="flex flex-col gap-4">
-			{#if externalConfigured || cluster === 'external_instance'}
-				<ToggleButtonGroup
-					noWFull
-					selected={cluster}
-					onSelected={(v) => {
-						prefill = ''
-						cluster = v
-					}}
-				>
-					{#snippet children({ item })}
-						<ToggleButton value="instance" label="Windmill instance" {item} />
-						<ToggleButton value="external_instance" label="External instance" {item} />
-					{/snippet}
-				</ToggleButtonGroup>
-			{/if}
-			{#key `${openCount}:${cluster}`}
-				<DataTableRolesSection {cluster} initialName={prefill} {onChanged} />
-			{/key}
-		</div>
+		{#key openCount}
+			<DataTableRolesSection initialName={prefill} {onChanged} />
+		{/key}
 	</DrawerContent>
 </Drawer>

frontend/src/lib/components/workspaceSettings/utils.svelte.ts

@@ -1,6 +1,6 @@
 import { isCloudHosted } from '$lib/cloud'
 
-import { enterpriseLicense, superadmin } from '$lib/stores'
+import { superadmin } from '$lib/stores'
 import { getLocalSetting } from '$lib/utils'
 import { derived } from 'svelte/store'
 
@@ -20,24 +20,6 @@ export let isCustomInstanceDbEnabled = derived(
 	([superadmin_]) => superadmin_ && !isCloudHosted()
 )
 
-export let isExternalInstanceDbEnabled = derived(
-	[superadmin, enterpriseLicense],
-	([superadmin_, enterpriseLicense_]) => superadmin_ && !!enterpriseLicense_ && !isCloudHosted()
-)
-
-/** Why the External instance option cannot be picked, or undefined when it can. */
-export let externalInstanceDbUnavailableReason = derived(
-	[superadmin, enterpriseLicense],
-	([superadmin_, enterpriseLicense_]) =>
-		isCloudHosted()
-			? 'Not available on cloud'
-			: !enterpriseLicense_
-				? 'Enterprise Edition only'
-				: !superadmin_
-					? 'Superadmin only'
-					: undefined
-)
-
 // Postgres caps identifiers at 63 bytes; the backend rejects longer db names.
 const MAX_INSTANCE_DB_NAME_LEN = 63