root/geo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(config): harden database pool settings

Browse Source
This commit is contained in:
liangxu
2026-05-03 15:04:08 +08:00
parent 774b907da8
commit cec7fa25e3
13 changed files with 105 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/.env.example
+1
View File
@@ -14,6 +14,7 @@ JWT_SECRET=geo-web-Aa123456-change-me-in-production
OPS_JWT_SECRET=geo-ops-Aa123456-change-me-in-production
OPS_DEFAULT_ADMIN_PASSWORD=Aa123456
SCHEDULER_INTERNAL_METRICS_TOKEN=geo-scheduler-Aa123456-change-me-in-production
POSTGRES_PASSWORD=geo_dev
# ─── Optional: MinIO credentials ─────────────────────────────────────────────
MINIO_ROOT_USER=admin
deploy/config.yaml
+8 -8
View File
@@ -3,24 +3,24 @@ server:
mode: release
database:
host: postgres
host: pgbouncer
port: 5432
user: geo
password: geo_dev
password: ${POSTGRES_PASSWORD:geo_dev}
dbname: geo
sslmode: disable
max_open_conns: 25
max_idle_conns: 5
max_open_conns: 12
max_idle_conns: 3
monitoring_database:
host: monitoring-postgres
host: monitoring-pgbouncer
port: 5432
user: geo
password: geo_dev
password: ${POSTGRES_PASSWORD:geo_dev}
dbname: geo_monitoring
sslmode: disable
max_open_conns: 25
max_idle_conns: 5
max_open_conns: 8
max_idle_conns: 2
rabbitmq:
url: amqp://geo:geo_dev@rabbitmq:5672/geo
deploy/k3s/apps.yaml
+30
View File
@@ -38,6 +38,11 @@ spec:
env:
- name: CONFIG_PATH
value: /app/configs/config.yaml
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: geo-rankly-app-secret
key: POSTGRES_PASSWORD
- name: TZ
value: Asia/Shanghai
- name: JWT_SECRET
@@ -125,6 +130,11 @@ spec:
env:
- name: CONFIG_PATH
value: /app/configs/config.yaml
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: geo-rankly-app-secret
key: POSTGRES_PASSWORD
- name: TZ
value: Asia/Shanghai
- name: JWT_SECRET
@@ -193,6 +203,11 @@ spec:
env:
- name: CONFIG_PATH
value: /app/configs/config.yaml
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: geo-rankly-app-secret
key: POSTGRES_PASSWORD
- name: TZ
value: Asia/Shanghai
- name: JWT_SECRET
@@ -278,6 +293,11 @@ spec:
env:
- name: CONFIG_PATH
value: /app/configs/config.yaml
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: geo-rankly-app-secret
key: POSTGRES_PASSWORD
- name: TZ
value: Asia/Shanghai
- name: SCHEDULER_HTTP_HOST
@@ -384,6 +404,16 @@ spec:
env:
- name: CONFIG_PATH
value: /app/configs/ops-config.yaml
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: geo-rankly-app-secret
key: POSTGRES_PASSWORD
- name: OPS_POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: geo-rankly-app-secret
key: POSTGRES_PASSWORD
- name: TZ
value: Asia/Shanghai
- name: OPS_JWT_SECRET
deploy/k3s/config/config.yaml
+8 -8
View File
@@ -3,24 +3,24 @@ server:
mode: release
database:
host: postgres
host: pgbouncer
port: 5432
user: geo
password: geo_dev
password: ${POSTGRES_PASSWORD:geo_dev}
dbname: geo
sslmode: disable
max_open_conns: 25
max_idle_conns: 5
max_open_conns: 12
max_idle_conns: 3
monitoring_database:
host: monitoring-postgres
host: monitoring-pgbouncer
port: 5432
user: geo
password: geo_dev
password: ${POSTGRES_PASSWORD:geo_dev}
dbname: geo_monitoring
sslmode: disable
max_open_conns: 25
max_idle_conns: 5
max_open_conns: 8
max_idle_conns: 2
rabbitmq:
url: amqp://geo:geo_dev@rabbitmq:5672/geo
deploy/k3s/config/ops-config.yaml
+6 -6
View File
@@ -3,23 +3,23 @@ server:
mode: release
database:
host: postgres
host: pgbouncer
port: 5432
user: geo
password: geo_dev
password: ${OPS_POSTGRES_PASSWORD:geo_dev}
dbname: geo
sslmode: disable
max_open_conns: 10
max_open_conns: 5
max_idle_conns: 2
monitoring_database:
host: monitoring-postgres
host: monitoring-pgbouncer
port: 5432
user: geo
password: geo_dev
password: ${OPS_POSTGRES_PASSWORD:geo_dev}
dbname: geo_monitoring
sslmode: disable
max_open_conns: 10
max_open_conns: 5
max_idle_conns: 2
redis:
deploy/k3s/jobs.yaml
+4 -3
View File
@@ -70,9 +70,10 @@ spec:
- /bin/sh
- -ec
- |
/usr/local/bin/migrate -path /migrations -database "postgres://geo:${POSTGRES_PASSWORD}@postgres:5432/geo?sslmode=disable" up
/usr/local/bin/migrate -path /migrations_monitoring -database "postgres://geo:${POSTGRES_PASSWORD}@monitoring-postgres:5432/geo_monitoring?sslmode=disable" up
/usr/local/bin/migrate -path /migrations_ops -database "postgres://geo:${POSTGRES_PASSWORD}@postgres:5432/geo?sslmode=disable&x-migrations-table=schema_migrations_ops" up
export PGPASSWORD="${POSTGRES_PASSWORD}"
/usr/local/bin/migrate -path /migrations -database "postgres://geo@postgres:5432/geo?sslmode=disable" up
/usr/local/bin/migrate -path /migrations_monitoring -database "postgres://geo@monitoring-postgres:5432/geo_monitoring?sslmode=disable" up
/usr/local/bin/migrate -path /migrations_ops -database "postgres://geo@postgres:5432/geo?sslmode=disable&x-migrations-table=schema_migrations_ops" up
/usr/local/bin/seed-platform-templates
volumes:
- name: app-config
deploy/k3s/secrets.yaml
+2 -2
View File
@@ -14,10 +14,10 @@ stringData:
SCHEDULER_INTERNAL_METRICS_TOKEN: geo-metrics-token
config.local.yaml: |
database:
password: geo_dev
password: ${POSTGRES_PASSWORD:geo_dev}
monitoring_database:
password: geo_dev
password: ${POSTGRES_PASSWORD:geo_dev}
rabbitmq:
url: amqp://geo:geo_dev@rabbitmq:5672/geo
deploy/ops-config.yaml
+6 -6
View File
@@ -3,23 +3,23 @@ server:
mode: release
database:
host: postgres
host: pgbouncer
port: 5432
user: geo
password: geo_dev
password: ${OPS_POSTGRES_PASSWORD:geo_dev}
dbname: geo
sslmode: disable
max_open_conns: 10
max_open_conns: 5
max_idle_conns: 2
monitoring_database:
host: monitoring-postgres
host: monitoring-pgbouncer
port: 5432
user: geo
password: geo_dev
password: ${OPS_POSTGRES_PASSWORD:geo_dev}
dbname: geo_monitoring
sslmode: disable
max_open_conns: 10
max_open_conns: 5
max_idle_conns: 2
redis:
server/configs/config.local.yaml.example
+5 -2
View File
@@ -11,6 +11,9 @@ database:
user: geo
password: geo_dev
dbname: geo
sslmode: disable
max_open_conns: 12
max_idle_conns: 3
monitoring_database:
host: localhost
@@ -19,8 +22,8 @@ monitoring_database:
password: geo_dev
dbname: geo_monitoring
sslmode: disable
max_open_conns: 25
max_idle_conns: 5
max_open_conns: 8
max_idle_conns: 2
rabbitmq:
url: amqp://geo:geo_dev@localhost:5672/geo
server/configs/config.yaml
+4 -4
View File
@@ -9,8 +9,8 @@ database:
password: geo_dev
dbname: geo
sslmode: disable
max_open_conns: 25
max_idle_conns: 5
max_open_conns: 12
max_idle_conns: 3
monitoring_database:
host: localhost
@@ -19,8 +19,8 @@ monitoring_database:
password: geo_dev
dbname: geo_monitoring
sslmode: disable
max_open_conns: 25
max_idle_conns: 5
max_open_conns: 8
max_idle_conns: 2
rabbitmq:
url: amqp://geo:geo_dev@localhost:5672/geo
server/configs/ops-config.yaml
+2 -2
View File
@@ -9,7 +9,7 @@ database:
password: geo_dev
dbname: geo
sslmode: disable
max_open_conns: 10
max_open_conns: 5
max_idle_conns: 2
monitoring_database:
@@ -19,7 +19,7 @@ monitoring_database:
password: geo_dev
dbname: geo_monitoring
sslmode: disable
max_open_conns: 10
max_open_conns: 5
max_idle_conns: 2
redis:
server/internal/shared/config/config.go
+12 -2
View File
@@ -4,6 +4,8 @@ import (
"crypto/tls"
"encoding/json"
"fmt"
"net"
"net/url"
"os"
"strings"
"time"
@@ -53,8 +55,16 @@ type DatabaseConfig struct {
}
func (d DatabaseConfig) DSN() string {
return fmt.Sprintf("postgres://%s:%s@%s:%d/%s?sslmode=%s",
d.User, d.Password, d.Host, d.Port, d.DBName, d.SSLMode)
u := url.URL{
Scheme: "postgres",
User: url.UserPassword(d.User, d.Password),
Host: net.JoinHostPort(d.Host, fmt.Sprintf("%d", d.Port)),
Path: "/" + d.DBName,
}
q := u.Query()
q.Set("sslmode", d.SSLMode)
u.RawQuery = q.Encode()
return u.String()
}
type RedisConfig struct {
server/internal/shared/config/config_test.go
+17
View File
@@ -27,6 +27,23 @@ llm:
}
}
func TestDatabaseConfigDSNEscapesCredentials(t *testing.T) {
cfg := DatabaseConfig{
Host: "db.internal",
Port: 5432,
User: "geo",
Password: "p@ss:word/with?symbols",
DBName: "geo",
SSLMode: "disable",
}
got := cfg.DSN()
want := "postgres://geo:p%40ss%3Aword%2Fwith%3Fsymbols@db.internal:5432/geo?sslmode=disable"
if got != want {
t.Fatalf("DSN() = %q, want %q", got, want)
}
}
func TestLoadFallsBackToConfigLLMAPIKey(t *testing.T) {
t.Setenv("LLM_API_KEY", "")