root/geo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(config): harden database pool settings

Browse Source
This commit is contained in:
liangxu
2026-05-03 15:04:08 +08:00
parent 774b907da8
commit cec7fa25e3
13 changed files with 105 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/.env.example
+1
View File
@@ -14,6 +14,7 @@ JWT_SECRET=geo-web-Aa123456-change-me-in-production
OPS_JWT_SECRET=geo-ops-Aa123456-change-me-in-production OPS_JWT_SECRET=geo-ops-Aa123456-change-me-in-production
OPS_DEFAULT_ADMIN_PASSWORD=Aa123456 OPS_DEFAULT_ADMIN_PASSWORD=Aa123456
SCHEDULER_INTERNAL_METRICS_TOKEN=geo-scheduler-Aa123456-change-me-in-production SCHEDULER_INTERNAL_METRICS_TOKEN=geo-scheduler-Aa123456-change-me-in-production
POSTGRES_PASSWORD=geo_dev
# ─── Optional: MinIO credentials ───────────────────────────────────────────── # ─── Optional: MinIO credentials ─────────────────────────────────────────────
MINIO_ROOT_USER=admin MINIO_ROOT_USER=admin
deploy/config.yaml
+8 -8
View File
@@ -3,24 +3,24 @@ server:
mode: release mode: release
database: database:
host: postgres host: pgbouncer
port: 5432 port: 5432
user: geo user: geo
password: geo_dev password: ${POSTGRES_PASSWORD:geo_dev}
dbname: geo dbname: geo
sslmode: disable sslmode: disable
max_open_conns: 25 max_open_conns: 12
max_idle_conns: 5 max_idle_conns: 3
monitoring_database: monitoring_database:
host: monitoring-postgres host: monitoring-pgbouncer
port: 5432 port: 5432
user: geo user: geo
password: geo_dev password: ${POSTGRES_PASSWORD:geo_dev}
dbname: geo_monitoring dbname: geo_monitoring
sslmode: disable sslmode: disable
max_open_conns: 25 max_open_conns: 8
max_idle_conns: 5 max_idle_conns: 2
rabbitmq: rabbitmq:
url: amqp://geo:geo_dev@rabbitmq:5672/geo url: amqp://geo:geo_dev@rabbitmq:5672/geo
deploy/k3s/apps.yaml
+30
View File
@@ -38,6 +38,11 @@ spec:
env: env:
- name: CONFIG_PATH - name: CONFIG_PATH
value: /app/configs/config.yaml value: /app/configs/config.yaml
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: geo-rankly-app-secret
key: POSTGRES_PASSWORD
- name: TZ - name: TZ
value: Asia/Shanghai value: Asia/Shanghai
- name: JWT_SECRET - name: JWT_SECRET
@@ -125,6 +130,11 @@ spec:
env: env:
- name: CONFIG_PATH - name: CONFIG_PATH
value: /app/configs/config.yaml value: /app/configs/config.yaml
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: geo-rankly-app-secret
key: POSTGRES_PASSWORD
- name: TZ - name: TZ
value: Asia/Shanghai value: Asia/Shanghai
- name: JWT_SECRET - name: JWT_SECRET
@@ -193,6 +203,11 @@ spec:
env: env:
- name: CONFIG_PATH - name: CONFIG_PATH
value: /app/configs/config.yaml value: /app/configs/config.yaml
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: geo-rankly-app-secret
key: POSTGRES_PASSWORD
- name: TZ - name: TZ
value: Asia/Shanghai value: Asia/Shanghai
- name: JWT_SECRET - name: JWT_SECRET
@@ -278,6 +293,11 @@ spec:
env: env:
- name: CONFIG_PATH - name: CONFIG_PATH
value: /app/configs/config.yaml value: /app/configs/config.yaml
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: geo-rankly-app-secret
key: POSTGRES_PASSWORD
- name: TZ - name: TZ
value: Asia/Shanghai value: Asia/Shanghai
- name: SCHEDULER_HTTP_HOST - name: SCHEDULER_HTTP_HOST
@@ -384,6 +404,16 @@ spec:
env: env:
- name: CONFIG_PATH - name: CONFIG_PATH
value: /app/configs/ops-config.yaml value: /app/configs/ops-config.yaml
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: geo-rankly-app-secret
key: POSTGRES_PASSWORD
- name: OPS_POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: geo-rankly-app-secret
key: POSTGRES_PASSWORD
- name: TZ - name: TZ
value: Asia/Shanghai value: Asia/Shanghai
- name: OPS_JWT_SECRET - name: OPS_JWT_SECRET
deploy/k3s/config/config.yaml
+8 -8
View File
@@ -3,24 +3,24 @@ server:
mode: release mode: release
database: database:
host: postgres host: pgbouncer
port: 5432 port: 5432
user: geo user: geo
password: geo_dev password: ${POSTGRES_PASSWORD:geo_dev}
dbname: geo dbname: geo
sslmode: disable sslmode: disable
max_open_conns: 25 max_open_conns: 12
max_idle_conns: 5 max_idle_conns: 3
monitoring_database: monitoring_database:
host: monitoring-postgres host: monitoring-pgbouncer
port: 5432 port: 5432
user: geo user: geo
password: geo_dev password: ${POSTGRES_PASSWORD:geo_dev}
dbname: geo_monitoring dbname: geo_monitoring
sslmode: disable sslmode: disable
max_open_conns: 25 max_open_conns: 8
max_idle_conns: 5 max_idle_conns: 2
rabbitmq: rabbitmq:
url: amqp://geo:geo_dev@rabbitmq:5672/geo url: amqp://geo:geo_dev@rabbitmq:5672/geo
deploy/k3s/config/ops-config.yaml
+6 -6
View File
@@ -3,23 +3,23 @@ server:
mode: release mode: release
database: database:
host: postgres host: pgbouncer
port: 5432 port: 5432
user: geo user: geo
password: geo_dev password: ${OPS_POSTGRES_PASSWORD:geo_dev}
dbname: geo dbname: geo
sslmode: disable sslmode: disable
max_open_conns: 10 max_open_conns: 5
max_idle_conns: 2 max_idle_conns: 2
monitoring_database: monitoring_database:
host: monitoring-postgres host: monitoring-pgbouncer
port: 5432 port: 5432
user: geo user: geo
password: geo_dev password: ${OPS_POSTGRES_PASSWORD:geo_dev}
dbname: geo_monitoring dbname: geo_monitoring
sslmode: disable sslmode: disable
max_open_conns: 10 max_open_conns: 5
max_idle_conns: 2 max_idle_conns: 2
redis: redis:
deploy/k3s/jobs.yaml
+4 -3
View File
@@ -70,9 +70,10 @@ spec:
- /bin/sh - /bin/sh
- -ec - -ec
- | - |
/usr/local/bin/migrate -path /migrations -database "postgres://geo:${POSTGRES_PASSWORD}@postgres:5432/geo?sslmode=disable" up export PGPASSWORD="${POSTGRES_PASSWORD}"
/usr/local/bin/migrate -path /migrations_monitoring -database "postgres://geo:${POSTGRES_PASSWORD}@monitoring-postgres:5432/geo_monitoring?sslmode=disable" up /usr/local/bin/migrate -path /migrations -database "postgres://geo@postgres:5432/geo?sslmode=disable" up
/usr/local/bin/migrate -path /migrations_ops -database "postgres://geo:${POSTGRES_PASSWORD}@postgres:5432/geo?sslmode=disable&x-migrations-table=schema_migrations_ops" up /usr/local/bin/migrate -path /migrations_monitoring -database "postgres://geo@monitoring-postgres:5432/geo_monitoring?sslmode=disable" up
/usr/local/bin/migrate -path /migrations_ops -database "postgres://geo@postgres:5432/geo?sslmode=disable&x-migrations-table=schema_migrations_ops" up
/usr/local/bin/seed-platform-templates /usr/local/bin/seed-platform-templates
volumes: volumes:
- name: app-config - name: app-config
deploy/k3s/secrets.yaml
+2 -2
View File
@@ -14,10 +14,10 @@ stringData:
SCHEDULER_INTERNAL_METRICS_TOKEN: geo-metrics-token SCHEDULER_INTERNAL_METRICS_TOKEN: geo-metrics-token
config.local.yaml: | config.local.yaml: |
database: database:
password: geo_dev password: ${POSTGRES_PASSWORD:geo_dev}
monitoring_database: monitoring_database:
password: geo_dev password: ${POSTGRES_PASSWORD:geo_dev}
rabbitmq: rabbitmq:
url: amqp://geo:geo_dev@rabbitmq:5672/geo url: amqp://geo:geo_dev@rabbitmq:5672/geo
deploy/ops-config.yaml
+6 -6
View File
@@ -3,23 +3,23 @@ server:
mode: release mode: release
database: database:
host: postgres host: pgbouncer
port: 5432 port: 5432
user: geo user: geo
password: geo_dev password: ${OPS_POSTGRES_PASSWORD:geo_dev}
dbname: geo dbname: geo
sslmode: disable sslmode: disable
max_open_conns: 10 max_open_conns: 5
max_idle_conns: 2 max_idle_conns: 2
monitoring_database: monitoring_database:
host: monitoring-postgres host: monitoring-pgbouncer
port: 5432 port: 5432
user: geo user: geo
password: geo_dev password: ${OPS_POSTGRES_PASSWORD:geo_dev}
dbname: geo_monitoring dbname: geo_monitoring
sslmode: disable sslmode: disable
max_open_conns: 10 max_open_conns: 5
max_idle_conns: 2 max_idle_conns: 2
redis: redis:
server/configs/config.local.yaml.example
+5 -2
View File
@@ -11,6 +11,9 @@ database:
user: geo user: geo
password: geo_dev password: geo_dev
dbname: geo dbname: geo
sslmode: disable
max_open_conns: 12
max_idle_conns: 3
monitoring_database: monitoring_database:
host: localhost host: localhost
@@ -19,8 +22,8 @@ monitoring_database:
password: geo_dev password: geo_dev
dbname: geo_monitoring dbname: geo_monitoring
sslmode: disable sslmode: disable
max_open_conns: 25 max_open_conns: 8
max_idle_conns: 5 max_idle_conns: 2
rabbitmq: rabbitmq:
url: amqp://geo:geo_dev@localhost:5672/geo url: amqp://geo:geo_dev@localhost:5672/geo
server/configs/config.yaml
+4 -4
View File
@@ -9,8 +9,8 @@ database:
password: geo_dev password: geo_dev
dbname: geo dbname: geo
sslmode: disable sslmode: disable
max_open_conns: 25 max_open_conns: 12
max_idle_conns: 5 max_idle_conns: 3
monitoring_database: monitoring_database:
host: localhost host: localhost
@@ -19,8 +19,8 @@ monitoring_database:
password: geo_dev password: geo_dev
dbname: geo_monitoring dbname: geo_monitoring
sslmode: disable sslmode: disable
max_open_conns: 25 max_open_conns: 8
max_idle_conns: 5 max_idle_conns: 2
rabbitmq: rabbitmq:
url: amqp://geo:geo_dev@localhost:5672/geo url: amqp://geo:geo_dev@localhost:5672/geo
server/configs/ops-config.yaml
+2 -2
View File
@@ -9,7 +9,7 @@ database:
password: geo_dev password: geo_dev
dbname: geo dbname: geo
sslmode: disable sslmode: disable
max_open_conns: 10 max_open_conns: 5
max_idle_conns: 2 max_idle_conns: 2
monitoring_database: monitoring_database:
@@ -19,7 +19,7 @@ monitoring_database:
password: geo_dev password: geo_dev
dbname: geo_monitoring dbname: geo_monitoring
sslmode: disable sslmode: disable
max_open_conns: 10 max_open_conns: 5
max_idle_conns: 2 max_idle_conns: 2
redis: redis:
server/internal/shared/config/config.go
+12 -2
View File
@@ -4,6 +4,8 @@ import (
"crypto/tls" "crypto/tls"
"encoding/json" "encoding/json"
"fmt" "fmt"
"net"
"net/url"
"os" "os"
"strings" "strings"
"time" "time"
@@ -53,8 +55,16 @@ type DatabaseConfig struct {
} }
func (d DatabaseConfig) DSN() string { func (d DatabaseConfig) DSN() string {
return fmt.Sprintf("postgres://%s:%s@%s:%d/%s?sslmode=%s", u := url.URL{
d.User, d.Password, d.Host, d.Port, d.DBName, d.SSLMode) Scheme: "postgres",
User: url.UserPassword(d.User, d.Password),
Host: net.JoinHostPort(d.Host, fmt.Sprintf("%d", d.Port)),
Path: "/" + d.DBName,
}
q := u.Query()
q.Set("sslmode", d.SSLMode)
u.RawQuery = q.Encode()
return u.String()
} }
type RedisConfig struct { type RedisConfig struct {
server/internal/shared/config/config_test.go
+17
View File
@@ -27,6 +27,23 @@ llm:
} }
} }
func TestDatabaseConfigDSNEscapesCredentials(t *testing.T) {
cfg := DatabaseConfig{
Host: "db.internal",
Port: 5432,
User: "geo",
Password: "p@ss:word/with?symbols",
DBName: "geo",
SSLMode: "disable",
}
got := cfg.DSN()
want := "postgres://geo:p%40ss%3Aword%2Fwith%3Fsymbols@db.internal:5432/geo?sslmode=disable"
if got != want {
t.Fatalf("DSN() = %q, want %q", got, want)
}
}
func TestLoadFallsBackToConfigLLMAPIKey(t *testing.T) { func TestLoadFallsBackToConfigLLMAPIKey(t *testing.T) {
t.Setenv("LLM_API_KEY", "") t.Setenv("LLM_API_KEY", "")