wan/sysmig
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
16 Commits 1 Branch 0 Tags
f691e38e9357f62539272b8b0c5b30d17d43c491
Commit Graph
3 Commits
Author SHA1 Message Date
wan f691e38e93 015: remote access - ocrt_dev db over TLS+SCRAM via PgBouncer 
- role ocrt_dev (LOGIN, random password in /var/lib/sysmig/secrets,
  not superuser - DB ownership suffices for schema migrations)
- database ocrt_dev owner ocrt_dev
- pgbouncer: listen 0.0.0.0, self-signed CA+cert (SAN=hostname/IPs),
  client_tls_sslmode=require, userlist synced from pg_authid (SCRAM
  pass-through; pg_hba unchanged)
- two pool aliases: ocrt_dev (transaction) and ocrt_dev_migrate
  (session, for advisory-lock-based migration tools)
- 013 status: listen_addr expectation flips once 015 is applied
- GCP firewall tcp:6432 remains a manual step (gcloud cmd in header)
 2026-08-31 22:34:32 +09:00
wan c639b5397f 013: make config dir/ini readable so non-root status works 
/etc/pgbouncer was 750 postgres:postgres, so "sysmig status" as the
login user false-DRIFTed on the -f check. Dir 755 + ini 644; userlist
(future SCRAM verifiers) stays 640 postgres.
 2026-08-31 22:26:17 +09:00
wan 08c585d048 013: PgBouncer transaction pooling on localhost:6432 
Serverless clients -> many short connections, few TPS. pool_mode=
transaction, max_client_conn=300, default_pool_size=20 (+reserve 5)
matching max_connections=30. max_prepared_statements=200 for ORM
prepared statements. localhost-only until remote-access migration
(roadmap 015). README table + notes updated.
 2026-08-31 22:21:53 +09:00