active_postgres 0.9.4 → 0.9.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b0966aed96fa6f906e7b048ef7804a0b9994c54f841f8dc9f00425f57f565a71
-  data.tar.gz: 86582950fc4afa733cba7052682dbaf0f3e76275c9397559f2d3398c8f92da86
+  metadata.gz: 8f31b928d75edd1c1c63a6534023a3c7255f4bce000487da5fb39ddd0bd357fb
+  data.tar.gz: ee835da34ead4b417ac2c5087e9fae0db12641c7dddb44e91fe795d083f4e61a
 SHA512:
-  metadata.gz: 18644b19453727a1b14918f9bc7d055fdf2c8cbaab962d94acdb058be4fa6b969e72e569ea5e1a2f0848cc45433e35c47dfa69af699370cb267b64c0a61114d5
-  data.tar.gz: '08b112f2121747a9b970809bf0c662dfbed99166edf6e3b18e88daab4fff0a65fcae13821c37fa69af218497b9ac05978d2bf6cd157c197d0f719f968088f407'
+  metadata.gz: 81cc77508c361ab128d840dbaac52ae9f3fc50b431fa971aaede91fc573ed9186521a53f8098e038515b6c96c82141100fd7ce797b0eae5c4b2840bd01330212
+  data.tar.gz: bcdeb64f655cbc0e702f5b70fc3c749daa103ac74945a9432627aeff6926de9b1974fa52547b32e1d99acec687d30b252473a15a75ffadd299e6bc951e9e2bf2

data/lib/active_postgres/components/pgbackrest.rb

@@ -212,7 +212,7 @@ module ActivePostgres
         env_content = log_archive_env(pgbackrest_config, log_archive_config, host)
         cron_content = log_archive_cron(log_archive_config)
 
-        install_apt_packages(host, 'awscli')
+        install_apt_packages(host, 's3cmd')
 
         ssh_executor.upload_file(host, env_content, LOG_ARCHIVE_ENV_FILE, mode: '640', owner: "root:#{postgres_user}")
 

data/lib/active_postgres/components/pgbouncer.rb

@@ -8,12 +8,16 @@ module ActivePostgres
           is_standby = config.standby_hosts.include?(host)
           install_on_host(host, is_standby: is_standby)
         end
+
+        pgbouncer_app_hosts.each do |app_host|
+          install_on_app_host(app_host)
+        end
       end
 
       def uninstall
         puts 'Uninstalling PgBouncer...'
 
-        config.all_hosts.each do |host|
+        (config.all_hosts + pgbouncer_app_hosts.map { |app_host| app_host.fetch('host') }).each do |host|
           ssh_executor.execute_on_host(host) do
             execute :sudo, 'systemctl', 'disable', '--now', 'pgbouncer-follow-primary.timer', '||', 'true'
             execute :sudo, 'rm', '-f', '/usr/local/bin/pgbouncer-follow-primary',
@@ -29,7 +33,7 @@ module ActivePostgres
       def restart
         puts 'Restarting PgBouncer...'
 
-        config.all_hosts.each do |host|
+        (config.all_hosts + pgbouncer_app_hosts.map { |app_host| app_host.fetch('host') }).each do |host|
           ssh_executor.execute_on_host(host) do
             execute :sudo, 'systemctl', 'restart', 'pgbouncer'
           end
@@ -46,6 +50,15 @@ module ActivePostgres
             execute :sudo, 'systemctl', 'reload', 'pgbouncer'
           end
         end
+
+        pgbouncer_app_hosts.each do |app_host|
+          host = app_host.fetch('host')
+          create_userlist_from_primary(host)
+
+          ssh_executor.execute_on_host(host) do
+            execute :sudo, 'systemctl', 'reload', 'pgbouncer'
+          end
+        end
       end
 
       def install_on_standby(standby_host)
@@ -55,6 +68,12 @@ module ActivePostgres
 
       private
 
+      def pgbouncer_app_hosts
+        return config.pgbouncer_app_hosts if config.respond_to?(:pgbouncer_app_hosts)
+
+        []
+      end
+
       def install_on_host(host, is_standby: false)
         puts "  Installing PgBouncer on #{host}..."
 
@@ -106,6 +125,45 @@ module ActivePostgres
         install_follow_primary(host, pgbouncer_config) if follow_primary
       end
 
+      def install_on_app_host(app_host)
+        host = app_host.fetch('host')
+        puts "  Installing PgBouncer on app host #{host}..."
+
+        user_config = config.component_config(:pgbouncer)
+        max_connections = get_postgres_max_connections(config.primary_host)
+        optimal_pool = ConnectionPooler.calculate_optimal_pool_sizes(max_connections)
+
+        pgbouncer_config = optimal_pool.merge(user_config)
+        pgbouncer_config[:database_host] = app_host_value(app_host, :database_host) || pgbouncer_primary_record
+        pgbouncer_config[:database_port] = app_host_value(app_host, :database_port) || pgbouncer_config[:database_port] || 5432
+        pgbouncer_config[:listen_addr] = app_host_value(app_host, :listen_addr) || pgbouncer_config[:app_listen_addr] || '127.0.0.1'
+        pgbouncer_config[:listen_port] = app_host_value(app_host, :listen_port) || pgbouncer_config[:app_listen_port] ||
+                                         pgbouncer_config[:listen_port] || 6432
+        ssl_enabled = config.component_enabled?(:ssl)
+        has_ca_cert = ssl_enabled && secrets.resolve('ssl_chain')
+        secrets_obj = secrets
+        _ = pgbouncer_config
+        _ = has_ca_cert
+        _ = secrets_obj
+
+        puts "  Calculated app pool settings for max_connections=#{max_connections}"
+
+        install_apt_packages(host, 'pgbouncer', 'postgresql-client')
+
+        upload_template(host, 'pgbouncer.ini.erb', '/etc/pgbouncer/pgbouncer.ini', binding, mode: '644')
+
+        setup_app_ssl_certs(host) if ssl_enabled
+
+        create_userlist_from_primary(host)
+
+        ssh_executor.execute_on_host(host) do
+          execute :sudo, 'systemctl', 'enable', 'pgbouncer'
+          execute :sudo, 'systemctl', 'restart', 'pgbouncer'
+        end
+
+        install_follow_dns_primary(host, pgbouncer_config)
+      end
+
       def follow_primary_for?(host, is_standby:, user_config:)
         if is_standby
           standby_config = config.standby_config_for(host) || {}
@@ -135,6 +193,32 @@ module ActivePostgres
         end
       end
 
+      def setup_app_ssl_certs(host)
+        puts '  Setting up SSL certificates for app PgBouncer...'
+
+        ssl_cert = secrets.resolve('ssl_cert')
+        ssl_key = secrets.resolve('ssl_key')
+        ssl_chain = secrets.resolve('ssl_chain')
+
+        unless ssl_cert && ssl_key
+          raise Error, 'PgBouncer app_hosts require ssl_cert and ssl_key secrets when ssl is enabled'
+        end
+
+        full_cert = if ssl_chain
+                      "#{ssl_cert.strip}\n#{ssl_chain.strip}\n"
+                    else
+                      ssl_cert
+                    end
+
+        ssh_executor.execute_on_host(host) do
+          execute :sudo, 'mkdir', '-p', '/etc/pgbouncer'
+        end
+
+        ssh_executor.upload_file(host, full_cert, '/etc/pgbouncer/server.crt', mode: '644', owner: 'postgres:postgres')
+        ssh_executor.upload_file(host, ssl_key, '/etc/pgbouncer/server.key', mode: '600', owner: 'postgres:postgres')
+        ssh_executor.upload_file(host, ssl_chain, '/etc/pgbouncer/ca.crt', mode: '644', owner: 'postgres:postgres') if ssl_chain
+      end
+
       def get_postgres_max_connections(host)
         # Try to get max_connections from running PostgreSQL
         postgres_user = config.postgres_user
@@ -154,18 +238,43 @@ module ActivePostgres
       def create_userlist(host)
         puts '  Creating PgBouncer userlist with database users...'
 
-        postgres_user = config.postgres_user
-        app_user = config.app_user
-        users_to_add = [postgres_user, (app_user if app_user != postgres_user)].compact
-        pgbouncer = self
+        component = self
 
         ssh_executor.execute_on_host(host) do
-          backend = self
-          userlist_entries = users_to_add.filter_map { |user| pgbouncer.send(:fetch_user_hash, backend, user, postgres_user) }
-          pgbouncer.send(:write_userlist_file, backend, userlist_entries)
+          userlist_entries = component.send(:userlist_entries_from_backend, self)
+          component.send(:write_userlist_file, self, userlist_entries)
         end
       end
 
+      def create_userlist_from_primary(host)
+        puts '  Creating app PgBouncer userlist from primary database users...'
+
+        userlist_entries = nil
+        component = self
+
+        ssh_executor.execute_on_host(config.primary_host) do
+          userlist_entries = component.send(:userlist_entries_from_backend, self)
+        end
+
+        ssh_executor.execute_on_host(host) do
+          component.send(:write_userlist_file, self, userlist_entries || [])
+        end
+      end
+
+      def userlist_entries_from_backend(backend)
+        postgres_user = config.postgres_user
+        users_to_add = pgbouncer_database_users
+
+        users_to_add.filter_map { |user| fetch_user_hash(backend, user, postgres_user) }
+      end
+
+      def pgbouncer_database_users
+        postgres_user = config.postgres_user
+        app_user = config.app_user
+
+        [postgres_user, (app_user if app_user != postgres_user)].compact
+      end
+
       def fetch_user_hash(backend, user, postgres_user)
         sql = build_user_hash_sql(user)
 
@@ -241,6 +350,40 @@ module ActivePostgres
           execute :sudo, 'systemctl', 'start', 'pgbouncer-follow-primary.service'
         end
       end
+
+      def install_follow_dns_primary(host, pgbouncer_config)
+        interval = pgbouncer_config[:follow_primary_interval] || 5
+        interval = interval.to_i
+        interval = 5 if interval <= 0
+        primary_record = pgbouncer_config[:database_host]
+        _ = interval
+        _ = primary_record
+        _ = pgbouncer_config
+
+        upload_template(host, 'pgbouncer_follow_dns_primary.sh.erb', '/usr/local/bin/pgbouncer-follow-primary',
+                        binding, mode: '755', owner: 'root:root')
+        upload_template(host, 'pgbouncer-follow-primary.service.erb',
+                        '/etc/systemd/system/pgbouncer-follow-primary.service', binding, mode: '644', owner: 'root:root')
+        upload_template(host, 'pgbouncer-follow-primary.timer.erb',
+                        '/etc/systemd/system/pgbouncer-follow-primary.timer', binding, mode: '644', owner: 'root:root')
+
+        ssh_executor.execute_on_host(host) do
+          execute :sudo, 'systemctl', 'daemon-reload'
+          execute :sudo, 'systemctl', 'enable', '--now', 'pgbouncer-follow-primary.timer'
+          execute :sudo, 'systemctl', 'start', 'pgbouncer-follow-primary.service'
+        end
+      end
+
+      def pgbouncer_primary_record
+        return config.pgbouncer_primary_record if config.respond_to?(:pgbouncer_primary_record)
+
+        dns_failover = config.component_config(:repmgr)[:dns_failover] || {}
+        dns_failover[:primary_record] || config.primary_replication_host
+      end
+
+      def app_host_value(app_host, key)
+        app_host[key.to_s] || app_host[key]
+      end
     end
   end
 end

data/lib/active_postgres/configuration.rb

@@ -39,6 +39,35 @@ module ActivePostgres
       [primary_host] + standby_hosts
     end
 
+    def pgbouncer_app_hosts
+      hosts = component_config(:pgbouncer)[:app_hosts] || component_config(:pgbouncer)['app_hosts'] || []
+      hosts = [hosts] unless hosts.is_a?(Array)
+
+      hosts.filter_map do |entry|
+        case entry
+        when String
+          entry.strip.empty? ? nil : { 'host' => entry.strip }
+        when Hash
+          host = entry['host'] || entry[:host] || entry['ip'] || entry[:ip]
+          next if host.to_s.strip.empty?
+
+          entry.merge('host' => host.to_s.strip)
+        end
+      end
+    end
+
+    def pgbouncer_primary_record
+      pgbouncer = component_config(:pgbouncer)
+      explicit = pgbouncer[:primary_record] || pgbouncer['primary_record']
+      return explicit.to_s.strip unless explicit.to_s.strip.empty?
+
+      dns_failover = component_config(:repmgr)[:dns_failover] || component_config(:repmgr)['dns_failover'] || {}
+      record = dns_failover[:primary_record] || dns_failover['primary_record']
+      return record.to_s.strip unless record.to_s.strip.empty?
+
+      primary_replication_host
+    end
+
     def primary_host
       @primary['host']
     end
@@ -114,6 +143,13 @@ module ActivePostgres
         end
       end
 
+      if component_enabled?(:pgbouncer)
+        pgbouncer_app_hosts.each do |app_host|
+          host = app_host['host'] || app_host[:host]
+          raise Error, 'pgbouncer.app_hosts entries must include host' if host.to_s.strip.empty?
+        end
+      end
+
         if component_enabled?(:repmgr)
           dns_failover = component_config(:repmgr)[:dns_failover]
           if dns_failover && dns_failover[:enabled]

data/lib/active_postgres/secrets.rb

@@ -96,6 +96,8 @@ module ActivePostgres
       return if defined?(::Rails) && ::Rails.respond_to?(:application) && ::Rails.application
 
       @rails_boot_attempted = true
+      ENV['RAILS_ENV'] ||= config.environment
+      ENV['BORING_ENVIRONMENT'] ||= config.environment
 
       # Try loading just the Rails application (without full initialization)
       # This makes Rails.application available for credential access

data/lib/active_postgres/version.rb

@@ -1,3 +1,3 @@
 module ActivePostgres
-  VERSION = '0.9.4'.freeze
+  VERSION = '0.9.5'.freeze
 end

data/templates/pgbackrest.conf.erb

@@ -57,6 +57,8 @@ log-path=/var/log/pgbackrest
 
 # Process settings
 process-max=<%= pgbackrest_config[:process_max] || 2 %>
+archive-async=y
+spool-path=/var/spool/pgbackrest
 
 # Start/Stop (for consistent backups)
 start-fast=y
@@ -68,4 +70,3 @@ pg1-port=5432
 pg1-socket-path=/var/run/postgresql
 pg1-user=<%= config.postgres_user %>
 
-

data/templates/pgbouncer.ini.erb

@@ -36,6 +36,8 @@ client_idle_timeout = <%= pgbouncer_config[:client_idle_timeout] || 0 %>
 client_login_timeout = <%= pgbouncer_config[:client_login_timeout] || 60 %>
 query_timeout = <%= pgbouncer_config[:query_timeout] || 0 %>
 query_wait_timeout = <%= pgbouncer_config[:query_wait_timeout] || 120 %>
+dns_max_ttl = <%= pgbouncer_config[:dns_max_ttl] || 5 %>
+dns_nxdomain_ttl = <%= pgbouncer_config[:dns_nxdomain_ttl] || 15 %>
 
 # Logging and administration
 admin_users = <%= pgbouncer_config[:admin_users] || config.postgres_user %>
@@ -62,4 +64,3 @@ pidfile = <%= pgbouncer_config[:pidfile] %>
 logfile = <%= pgbouncer_config[:logfile] %>
 <% end %>
 
-

data/templates/pgbouncer_follow_dns_primary.sh.erb

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+PRIMARY_RECORD="<%= primary_record %>"
+PGBOUNCER_INI="/etc/pgbouncer/pgbouncer.ini"
+PGBOUNCER_SERVICE="pgbouncer"
+STATE_DIR="/var/lib/active-postgres"
+STATE_FILE="${STATE_DIR}/pgbouncer-primary-ip"
+LOG_TAG="pgbouncer-follow-primary"
+
+resolved_ip=$(getent ahostsv4 "$PRIMARY_RECORD" | awk '{print $1; exit}' || true)
+if [[ -z "$resolved_ip" ]]; then
+  /usr/bin/logger -t "$LOG_TAG" "Could not resolve ${PRIMARY_RECORD}"
+  exit 1
+fi
+
+current_host=$(awk -F'host=' '/^\\* = host=/{print $2}' "$PGBOUNCER_INI" | awk '{print $1}')
+previous_ip=""
+if [[ -f "$STATE_FILE" ]]; then
+  previous_ip=$(cat "$STATE_FILE")
+fi
+
+changed=0
+if [[ "$current_host" != "$PRIMARY_RECORD" ]]; then
+  /usr/bin/sed -i -E "s/^(\\* = host=)[^ ]+/\\1${PRIMARY_RECORD}/" "$PGBOUNCER_INI"
+  changed=1
+fi
+
+if [[ "$previous_ip" != "$resolved_ip" ]]; then
+  changed=1
+fi
+
+/usr/bin/install -d -m 0755 "$STATE_DIR"
+printf "%s\n" "$resolved_ip" > "$STATE_FILE"
+
+if [[ "$changed" == "1" ]]; then
+  /usr/bin/systemctl restart "$PGBOUNCER_SERVICE"
+  /usr/bin/logger -t "$LOG_TAG" "Refreshed PgBouncer primary target ${PRIMARY_RECORD} (${resolved_ip})"
+fi

data/templates/postgres_log_archive.sh.erb

@@ -46,12 +46,43 @@ if [[ ${#tar_paths[@]} -eq 0 ]]; then
   exit 0
 fi
 
-tar -czf "$archive" -C / "${tar_paths[@]}"
+set +e
+tar --warning=no-file-changed --ignore-failed-read -czf "$archive" -C / "${tar_paths[@]}"
+tar_status=$?
+set -e
 
-destination="s3://${AWS_BUCKET}/${PREFIX%/}/${NODE}/${DATE_PATH}/$(basename "$archive")"
-aws_args=(s3 cp "$archive" "$destination" --only-show-errors)
-if [[ -n "${AWS_ENDPOINT_URL:-}" ]]; then
-  aws_args+=(--endpoint-url "$AWS_ENDPOINT_URL")
+if [[ $tar_status -gt 1 ]]; then
+  exit "$tar_status"
 fi
 
-aws "${aws_args[@]}"
+if [[ ! -s "$archive" ]]; then
+  exit 0
+fi
+
+destination="s3://${AWS_BUCKET}/${PREFIX%/}/${NODE}/${DATE_PATH}/$(basename "$archive")"
+if command -v aws >/dev/null 2>&1; then
+  aws_args=(s3 cp "$archive" "$destination" --only-show-errors)
+  if [[ -n "${AWS_ENDPOINT_URL:-}" ]]; then
+    aws_args+=(--endpoint-url "$AWS_ENDPOINT_URL")
+  fi
+
+  aws "${aws_args[@]}"
+elif command -v s3cmd >/dev/null 2>&1; then
+  s3cmd_args=(
+    --access_key="$AWS_ACCESS_KEY_ID"
+    --secret_key="$AWS_SECRET_ACCESS_KEY"
+    --region="${AWS_DEFAULT_REGION:-us-east-1}"
+    --no-progress
+  )
+
+  if [[ -n "${AWS_ENDPOINT_URL:-}" ]]; then
+    endpoint="${AWS_ENDPOINT_URL#https://}"
+    endpoint="${endpoint#http://}"
+    s3cmd_args+=(--host="$endpoint" --host-bucket="${endpoint}/%(bucket)")
+  fi
+
+  s3cmd "${s3cmd_args[@]}" put "$archive" "$destination"
+else
+  echo "missing aws or s3cmd command for PostgreSQL log archive" >&2
+  exit 1
+fi

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: active_postgres
 version: !ruby/object:Gem::Version
-  version: 0.9.4
+  version: 0.9.5
 platform: ruby
 authors:
 - BoringCache
@@ -199,6 +199,7 @@ files:
 - templates/pgbouncer-follow-primary.service.erb
 - templates/pgbouncer-follow-primary.timer.erb
 - templates/pgbouncer.ini.erb
+- templates/pgbouncer_follow_dns_primary.sh.erb
 - templates/pgbouncer_follow_primary.sh.erb
 - templates/postgres_log_archive.sh.erb
 - templates/postgresql.conf.erb