wan/sysmig
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

015: remote access - ocrt_dev db over TLS+SCRAM via PgBouncer

Browse Source 
- role ocrt_dev (LOGIN, random password in /var/lib/sysmig/secrets,
  not superuser - DB ownership suffices for schema migrations)
- database ocrt_dev owner ocrt_dev
- pgbouncer: listen 0.0.0.0, self-signed CA+cert (SAN=hostname/IPs),
  client_tls_sslmode=require, userlist synced from pg_authid (SCRAM
  pass-through; pg_hba unchanged)
- two pool aliases: ocrt_dev (transaction) and ocrt_dev_migrate
  (session, for advisory-lock-based migration tools)
- 013 status: listen_addr expectation flips once 015 is applied
- GCP firewall tcp:6432 remains a manual step (gcloud cmd in header)
This commit is contained in:
wan
2026-08-31 22:34:32 +09:00
parent c639b5397f
commit f691e38e93
3 changed files with 219 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+14 -10
View File
@@ -56,18 +56,22 @@ For a private repo you need an auth strategy:
| 011 | postgres-observability | pg_stat_statements, slow-log 500ms, io timing |
| 012 | tune-cpu | parallel caps + jit=off for shared 2 vCPU |
| 013 | install-pgbouncer | :6432 transaction pooling, localhost-only |
| 015 | remote-access | ocrt_dev db+role, TLS+SCRAM, listen 0.0.0.0 |
## PgBouncer notes (013)
## PgBouncer notes (013/015)
Serverless clients (many connections, few TPS) connect to PgBouncer
(`127.0.0.1:6432`, transaction mode) which opens at most ~25 real
PostgreSQL backends - matching `max_connections=30` from 010 with room
for admin sessions. Remote access is deliberately not opened yet; when
it is: create an app role with a SCRAM password, export its verifier into
`/etc/pgbouncer/userlist.txt` (snippet in 013's header), flip
`listen_addr` and open the firewall.
on `:6432`; PostgreSQL keeps `max_connections=30` (010) with headroom
for admin sessions. Since 015, PgBouncer listens on `0.0.0.0` with
mandatory TLS (self-signed CA in `/etc/pgbouncer/tls`) and SCRAM auth
via `/etc/pgbouncer/userlist.txt` (synced from `pg_authid`). The app
database is `ocrt_dev`, owned by role `ocrt_dev` (not superuser - DB
ownership is enough for schema migrations); its password lives at
`/var/lib/sysmig/secrets/ocrt_dev.pass` (root-only).
## Roadmap
Two pool aliases point at the same database: `ocrt_dev` (transaction
mode - runtime) and `ocrt_dev_migrate` (session mode - for migration
tools that use session advisory locks, e.g. Prisma).
- `015-remote-access` - app role + SCRAM credentials, pgbouncer
`listen_addr` + userlist.txt, pg_hba for the app CIDR, TLS, firewall
The GCP firewall rule for tcp:6432 is managed outside sysmig (see 015
header for the gcloud command).