fix(config): harden database pool settings

server/configs/config.local.yaml.example

@@ -11,6 +11,9 @@ database:
   user: geo
   password: geo_dev
   dbname: geo
+  sslmode: disable
+  max_open_conns: 12
+  max_idle_conns: 3
 
 monitoring_database:
   host: localhost
@@ -19,8 +22,8 @@ monitoring_database:
   password: geo_dev
   dbname: geo_monitoring
   sslmode: disable
-  max_open_conns: 25
-  max_idle_conns: 5
+  max_open_conns: 8
+  max_idle_conns: 2
 
 rabbitmq:
   url: amqp://geo:geo_dev@localhost:5672/geo

server/configs/config.yaml

@@ -9,8 +9,8 @@ database:
   password: geo_dev
   dbname: geo
   sslmode: disable
-  max_open_conns: 25
-  max_idle_conns: 5
+  max_open_conns: 12
+  max_idle_conns: 3
 
 monitoring_database:
   host: localhost
@@ -19,8 +19,8 @@ monitoring_database:
   password: geo_dev
   dbname: geo_monitoring
   sslmode: disable
-  max_open_conns: 25
-  max_idle_conns: 5
+  max_open_conns: 8
+  max_idle_conns: 2
 
 rabbitmq:
   url: amqp://geo:geo_dev@localhost:5672/geo

server/configs/ops-config.yaml

@@ -9,7 +9,7 @@ database:
   password: geo_dev
   dbname: geo
   sslmode: disable
-  max_open_conns: 10
+  max_open_conns: 5
   max_idle_conns: 2
 
 monitoring_database:
@@ -19,7 +19,7 @@ monitoring_database:
   password: geo_dev
   dbname: geo_monitoring
   sslmode: disable
-  max_open_conns: 10
+  max_open_conns: 5
   max_idle_conns: 2
 
 redis:

server/internal/shared/config/config.go

@@ -4,6 +4,8 @@ import (
 	"crypto/tls"
 	"encoding/json"
 	"fmt"
+	"net"
+	"net/url"
 	"os"
 	"strings"
 	"time"
@@ -53,8 +55,16 @@ type DatabaseConfig struct {
 }
 
 func (d DatabaseConfig) DSN() string {
-	return fmt.Sprintf("postgres://%s:%s@%s:%d/%s?sslmode=%s",
-		d.User, d.Password, d.Host, d.Port, d.DBName, d.SSLMode)
+	u := url.URL{
+		Scheme: "postgres",
+		User:   url.UserPassword(d.User, d.Password),
+		Host:   net.JoinHostPort(d.Host, fmt.Sprintf("%d", d.Port)),
+		Path:   "/" + d.DBName,
+	}
+	q := u.Query()
+	q.Set("sslmode", d.SSLMode)
+	u.RawQuery = q.Encode()
+	return u.String()
 }
 
 type RedisConfig struct {

server/internal/shared/config/config_test.go

@@ -27,6 +27,23 @@ llm:
 	}
 }
 
+func TestDatabaseConfigDSNEscapesCredentials(t *testing.T) {
+	cfg := DatabaseConfig{
+		Host:     "db.internal",
+		Port:     5432,
+		User:     "geo",
+		Password: "p@ss:word/with?symbols",
+		DBName:   "geo",
+		SSLMode:  "disable",
+	}
+
+	got := cfg.DSN()
+	want := "postgres://geo:p%40ss%3Aword%2Fwith%3Fsymbols@db.internal:5432/geo?sslmode=disable"
+	if got != want {
+		t.Fatalf("DSN() = %q, want %q", got, want)
+	}
+}
+
 func TestLoadFallsBackToConfigLLMAPIKey(t *testing.T) {
 	t.Setenv("LLM_API_KEY", "")