active_postgres 0.9.5 → 0.9.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8f31b928d75edd1c1c63a6534023a3c7255f4bce000487da5fb39ddd0bd357fb
-  data.tar.gz: ee835da34ead4b417ac2c5087e9fae0db12641c7dddb44e91fe795d083f4e61a
+  metadata.gz: 5d06925c9a64ca3f5b96402257fda9ad13f32bbd0e3ac5377032d737c71fb2ea
+  data.tar.gz: 19cde3ee7e86d325378661aa72350d51d1bfebf33a2e6f03a1c90d34c987a997
 SHA512:
-  metadata.gz: 81cc77508c361ab128d840dbaac52ae9f3fc50b431fa971aaede91fc573ed9186521a53f8098e038515b6c96c82141100fd7ce797b0eae5c4b2840bd01330212
-  data.tar.gz: bcdeb64f655cbc0e702f5b70fc3c749daa103ac74945a9432627aeff6926de9b1974fa52547b32e1d99acec687d30b252473a15a75ffadd299e6bc951e9e2bf2
+  metadata.gz: 2dbcc33b6ad2ffadeeea4145bc5bc36910203002af908030893298df2005089e87fa8e5d465a425ffae11c60ee01b66f301e1ae594e3bb662d747c0c342b20cb
+  data.tar.gz: 2772e4a192f87c60d54ccaaeb5ea2952f7a98ce34f3daec5839e77758179f75f3f9ac09a76ab74bc929311b8b417e074e5ae156f286bbba55423c3a923b47d77

data/CHANGELOG.md

@@ -0,0 +1,23 @@
+# Changelog
+
+All notable changes to Active Postgres will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project follows [Semantic Versioning](https://semver.org/).
+
+## Unreleased
+
+## 0.9.6 - 2026-08-20
+
+### Changed
+
+- Require Ruby 4.0 or newer and Rails 8.1 or newer for Rails integration.
+- Align runtime and development dependencies with the maintained toolchain.
+- Add blocking test, lint, dependency-audit, and package-build CI checks.
+- Add automated Bundler and GitHub Actions dependency updates.
+- Document network, credential, failover, and recovery responsibilities.
+
+## 0.9.5
+
+- Current published release. See the repository history for changes included in
+  earlier releases.

data/README.md

@@ -1,6 +1,10 @@
 # active_postgres
 
-Production-grade PostgreSQL HA for Rails.
+PostgreSQL high-availability automation for Ruby and Rails applications.
+
+Active Postgres configures hosts you control over SSH. It is an operations tool,
+not a managed database service: you remain responsible for network isolation,
+capacity planning, monitoring, backups, recovery drills, and failover decisions.
 
 ## Features
 
@@ -272,11 +276,23 @@ User.all                     # → Replica
 
 ## Requirements
 
-- Ruby 3.0+
-- PostgreSQL 12+
+- Ruby 4.0+
+- A PostgreSQL version supported by the target Linux distribution
 - Ubuntu 20.04+ / Debian 11+ with systemd
 - SSH key-based authentication (hosts must be in `~/.ssh/known_hosts`)
-- Rails 6.0+ (optional)
+- Rails 8.1+ (optional)
+
+## Operational safety
+
+- Keep PostgreSQL, PgBouncer, exporters, and backup endpoints behind a private
+  network or narrowly scoped firewall rules.
+- Test promotion, application reconnection, backup restore, and point-in-time
+  recovery in a disposable environment before using them in production.
+- Review generated configuration and package changes before each rollout;
+  automatic failover cannot determine whether an application is safe to write
+  after a network partition.
+- Store database, replication, monitoring, and backup credentials in a secret
+  manager. Do not commit resolved values or generated configuration.
 
 ### SSH host key verification
 

data/SECURITY.md

@@ -0,0 +1,21 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please do not open a public issue for a potential vulnerability. Email
+[security@boringcache.com](mailto:security@boringcache.com) or use
+[GitHub private vulnerability reporting](https://github.com/boringcache/active_postgres/security/advisories/new).
+
+Include the affected version, expected impact, and enough reproduction detail
+for us to investigate. Do not include database credentials, private keys,
+backups, customer data, or production configuration.
+
+## Supported Versions
+
+Only the latest published release is supported. Security fixes are normally
+shipped in a new release rather than backported.
+
+## Scope
+
+Reports about PostgreSQL authentication, replication, backup/restore, SSH host
+verification, secret handling, generated SQL, or release integrity are welcome.

data/lib/active_postgres/components/base.rb

@@ -1,3 +1,5 @@
+require 'erb'
+
 module ActivePostgres
   module Components
     class Base

data/lib/active_postgres/components/core.rb

@@ -136,7 +136,7 @@ module ActivePostgres
       end
 
       def ensure_standby_compatible(pg_config)
-        primary_settings = get_primary_replication_settings
+        primary_settings = primary_replication_settings
         return pg_config if primary_settings.empty?
 
         adjustments = []
@@ -154,17 +154,24 @@ module ActivePostgres
         end
 
         if adjustments.any?
-          puts "  ⚠️  Adjusting standby settings to match primary minimum:"
+          puts '  ⚠️  Adjusting standby settings to match primary minimum:'
           adjustments.each { |adj| puts "      #{adj}" }
         end
 
         pg_config
       end
 
-      def get_primary_replication_settings
+      def primary_replication_settings
         @primary_replication_settings ||= begin
           settings = {}
-          sql = "SELECT name || '=' || setting FROM pg_settings WHERE name IN ('max_connections', 'max_worker_processes', 'max_wal_senders', 'max_prepared_transactions', 'max_locks_per_transaction')"
+          setting_names = %w[
+            max_connections
+            max_worker_processes
+            max_wal_senders
+            max_prepared_transactions
+            max_locks_per_transaction
+          ]
+          sql = "SELECT name || '=' || setting FROM pg_settings WHERE name IN (#{setting_names.map { |name| "'#{name}'" }.join(', ')})"
           result = ssh_executor.run_sql(config.primary_host, sql)
           result.strip.split("\n").each do |line|
             name, val = line.split('=')

data/lib/active_postgres/components/monitoring.rb

@@ -1,4 +1,4 @@
-require 'cgi'
+require 'cgi/escape'
 
 module ActivePostgres
   module Components
@@ -83,7 +83,7 @@ module ActivePostgres
         sql = build_monitoring_user_sql(monitoring_user, monitoring_password)
 
         ssh_executor.run_sql(config.primary_host, sql, postgres_user: 'postgres', port: 5432, tuples_only: false,
-                                                     capture: false)
+                                                       capture: false)
       end
 
       def build_monitoring_user_sql(user, password)

data/lib/active_postgres/components/pgbackrest.rb

@@ -3,9 +3,9 @@ require 'shellwords'
 module ActivePostgres
   module Components
     class PgBackRest < Base
-      LOG_ARCHIVE_CRON_FILE = '/etc/cron.d/postgres-log-archive'
-      LOG_ARCHIVE_ENV_FILE = '/etc/active-postgres-log-archive.env'
-      LOG_ARCHIVE_SCRIPT = '/usr/local/bin/active-postgres-archive-logs'
+      LOG_ARCHIVE_CRON_FILE = '/etc/cron.d/postgres-log-archive'.freeze
+      LOG_ARCHIVE_ENV_FILE = '/etc/active-postgres-log-archive.env'.freeze
+      LOG_ARCHIVE_SCRIPT = '/usr/local/bin/active-postgres-archive-logs'.freeze
 
       def install
         puts 'Installing pgBackRest for backups...'
@@ -135,9 +135,7 @@ module ActivePostgres
           execute :sudo, 'chown', "#{postgres_user}:#{postgres_user}", '/var/spool/pgbackrest'
 
           # Only create stanza on primary - standbys share the same backup repo
-          if create_stanza
-            execute :sudo, '-u', postgres_user, 'pgbackrest', '--stanza=main', 'stanza-create'
-          end
+          execute :sudo, '-u', postgres_user, 'pgbackrest', '--stanza=main', 'stanza-create' if create_stanza
         end
 
         if log_archive_enabled?(pgbackrest_config)
@@ -167,12 +165,8 @@ module ActivePostgres
         schedule_incremental = pgbackrest_config[:schedule_incremental]
 
         schedules = []
-        if schedule_full
-          schedules << { type: 'full', schedule: schedule_full, file: '/etc/cron.d/pgbackrest-backup' }
-        end
-        if schedule_incremental
-          schedules << { type: 'incremental', schedule: schedule_incremental, file: '/etc/cron.d/pgbackrest-backup-incremental' }
-        end
+        schedules << { type: 'full', schedule: schedule_full, file: '/etc/cron.d/pgbackrest-backup' } if schedule_full
+        schedules << { type: 'incr', schedule: schedule_incremental, file: '/etc/cron.d/pgbackrest-backup-incremental' } if schedule_incremental
 
         schedules
       end
@@ -204,9 +198,7 @@ module ActivePostgres
 
       def setup_log_archive(host, pgbackrest_config)
         log_archive_config = pgbackrest_config[:log_archive] || {}
-        unless pgbackrest_config[:repo_type] == 's3'
-          raise Error, 'pgbackrest.log_archive requires pgbackrest.repo_type: s3'
-        end
+        raise Error, 'pgbackrest.log_archive requires pgbackrest.repo_type: s3' unless pgbackrest_config[:repo_type] == 's3'
 
         postgres_user = config.postgres_user
         env_content = log_archive_env(pgbackrest_config, log_archive_config, host)
@@ -260,13 +252,13 @@ module ActivePostgres
           'POSTGRES_LOG_ARCHIVE_NODE' => config.node_label_for(host) || host
         }.compact
 
-        env.map { |key, value| "#{key}=#{Shellwords.escape(value.to_s)}" }.join("\n") + "\n"
+        "#{env.map { |key, value| "#{key}=#{Shellwords.escape(value.to_s)}" }.join("\n")}\n"
       end
 
       def s3_endpoint_url(pgbackrest_config)
         endpoint = pgbackrest_config[:s3_endpoint]
         return nil if endpoint.to_s.empty?
-        return endpoint if endpoint.match?(/\Ahttps?:\/\//)
+        return endpoint if endpoint.match?(%r{\Ahttps?://})
 
         "https://#{endpoint}"
       end

data/lib/active_postgres/components/pgbouncer.rb

@@ -81,9 +81,7 @@ module ActivePostgres
 
         follow_primary = follow_primary_for?(host, is_standby: is_standby, user_config: user_config)
 
-        if follow_primary && !config.component_enabled?(:repmgr)
-          raise Error, 'PgBouncer follow_primary requires repmgr to be enabled'
-        end
+        raise Error, 'PgBouncer follow_primary requires repmgr to be enabled' if follow_primary && !config.component_enabled?(:repmgr)
 
         max_connections = get_postgres_max_connections(host)
         optimal_pool = ConnectionPooler.calculate_optimal_pool_sizes(max_connections)
@@ -188,9 +186,9 @@ module ActivePostgres
         end
 
         ssl_chain = secrets.resolve('ssl_chain')
-        if ssl_chain
-          ssh_executor.upload_file(host, ssl_chain, '/etc/pgbouncer/ca.crt', mode: '644', owner: 'postgres:postgres')
-        end
+        return unless ssl_chain
+
+        ssh_executor.upload_file(host, ssl_chain, '/etc/pgbouncer/ca.crt', mode: '644', owner: 'postgres:postgres')
       end
 
       def setup_app_ssl_certs(host)
@@ -200,9 +198,7 @@ module ActivePostgres
         ssl_key = secrets.resolve('ssl_key')
         ssl_chain = secrets.resolve('ssl_chain')
 
-        unless ssl_cert && ssl_key
-          raise Error, 'PgBouncer app_hosts require ssl_cert and ssl_key secrets when ssl is enabled'
-        end
+        raise Error, 'PgBouncer app_hosts require ssl_cert and ssl_key secrets when ssl is enabled' unless ssl_cert && ssl_key
 
         full_cert = if ssl_chain
                       "#{ssl_cert.strip}\n#{ssl_chain.strip}\n"

data/lib/active_postgres/components/repmgr.rb

@@ -114,6 +114,7 @@ module ActivePostgres
         if replication_user == repmgr_user && replication_password != repmgr_password
           raise Error, 'replication_user matches repmgr user but passwords differ. Use a distinct replication_user or the same password.'
         end
+
         effective_replication_password = replication_user == repmgr_user ? repmgr_password : replication_password
 
         # Variables used in ERB templates via binding
@@ -174,13 +175,13 @@ module ActivePostgres
           info 'Creating repmgr database and user...'
           repmgr_sql = repmgr_component.send(:build_repmgr_setup_sql, repmgr_user, repmgr_db, repmgr_password)
           executor.run_sql_on_backend(self, repmgr_sql, postgres_user: 'postgres', port: 5432, tuples_only: false,
-                                           capture: false)
+                                                        capture: false)
 
           if replication_user != repmgr_user
             info 'Ensuring replication user exists...'
             repl_sql = repmgr_component.send(:build_replication_user_sql, replication_user, effective_replication_password)
             executor.run_sql_on_backend(self, repl_sql, postgres_user: 'postgres', port: 5432, tuples_only: false,
-                                             capture: false)
+                                                        capture: false)
           end
 
           info 'Reloading PostgreSQL configuration to apply pg_hba.conf changes...'
@@ -202,14 +203,14 @@ module ActivePostgres
           cluster_show = nil
           5.times do |attempt|
             cluster_show = capture(:sudo, '-u', 'postgres', 'bash', '-lc',
-                                   "repmgr cluster show -f /etc/repmgr.conf 2>&1", raise_on_non_zero_exit: false).to_s
+                                   'repmgr cluster show -f /etc/repmgr.conf 2>&1', raise_on_non_zero_exit: false).to_s
 
             break if cluster_show.match?(/primary/i)
 
             sleep 2 if attempt < 4
           end
 
-          unless cluster_show && cluster_show.match?(/primary/i)
+          unless cluster_show&.match?(/primary/i)
             # Fallback: verify via repmgr metadata in the repmgr database
             db_check = executor.run_sql_on_backend(self,
                                                    'SELECT type FROM repmgr.nodes WHERE node_id = 1;',
@@ -255,13 +256,14 @@ module ActivePostgres
         if replication_user == repmgr_user && replication_password != repmgr_password
           raise Error, 'replication_user matches repmgr user but passwords differ. Use a distinct replication_user or the same password.'
         end
+
         effective_replication_password = replication_user == repmgr_user ? repmgr_password : replication_password
 
         ensure_primary_registered
         ensure_primary_replication_ready(repmgr_password, effective_replication_password)
 
         setup_pgpass_file(standby_host, repmgr_password, replication_password: effective_replication_password,
-                                                      primary_ip: primary_replication_host)
+                                                         primary_ip: primary_replication_host)
 
         if standby_already_configured?(standby_host)
           puts '  Standby already configured, updating configs...'
@@ -418,9 +420,10 @@ module ActivePostgres
 
       def setup_inter_node_ssh
         dns_config = dns_failover_config
-        key_path = dns_config && dns_config[:ssh_key_path] || '/var/lib/postgresql/.ssh/active_postgres_dns'
+        key_path = (dns_config && dns_config[:ssh_key_path]) || '/var/lib/postgresql/.ssh/active_postgres_dns'
         postgres_user = config.postgres_user
         all_hosts = config.all_hosts
+        replication_hosts = all_hosts.to_h { |host| [host, config.replication_host_for(host)] }
         pub_keys = {}
 
         all_hosts.each do |host|
@@ -430,18 +433,35 @@ module ActivePostgres
         all_hosts.each do |host|
           ssh_executor.execute_on_host(host) do
             other_keys = pub_keys.reject { |h, _| h == host }.values
-            other_keys.each do |key|
-              next if key.to_s.empty?
-
-              upload! StringIO.new("#{key}\n"), '/tmp/pg_peer_key.pub'
-              execute :sudo, '-u', postgres_user, 'bash', '-c',
-                      "grep -qxF -f /tmp/pg_peer_key.pub /var/lib/postgresql/.ssh/authorized_keys 2>/dev/null || cat /tmp/pg_peer_key.pub >> /var/lib/postgresql/.ssh/authorized_keys"
-              execute :rm, '-f', '/tmp/pg_peer_key.pub'
+            authorized_keys_path = '/var/lib/postgresql/.ssh/authorized_keys'
+            existing_keys = if test(:sudo, 'test', '-f', authorized_keys_path)
+                              capture(:sudo, 'cat', authorized_keys_path).lines.map(&:strip)
+                            else
+                              []
+                            end
+            authorized_keys = (existing_keys + other_keys.map(&:to_s).map(&:strip)).reject(&:empty?).uniq.join("\n")
+            unless authorized_keys.empty?
+              upload! StringIO.new("#{authorized_keys}\n"), '/tmp/pg_authorized_keys'
+              execute :sudo, 'mv', '/tmp/pg_authorized_keys', authorized_keys_path
+              execute :sudo, 'chown', "#{postgres_user}:#{postgres_user}", authorized_keys_path
+              execute :sudo, 'chmod', '600', authorized_keys_path
             end
 
-            peer_ips = all_hosts.reject { |h| h == host }.map { |h| config.replication_host_for(h) }
-            scan_cmd = "ssh-keyscan #{peer_ips.join(' ')} >> /var/lib/postgresql/.ssh/known_hosts 2>/dev/null || true"
-            execute :sudo, '-u', postgres_user, 'bash', '-c', scan_cmd
+            peer_ips = all_hosts.reject { |h| h == host }.map { |h| replication_hosts[h] }
+            known_hosts_path = '/var/lib/postgresql/.ssh/known_hosts'
+            existing_hosts = if test(:sudo, 'test', '-f', known_hosts_path)
+                               capture(:sudo, 'cat', known_hosts_path).lines.map(&:strip)
+                             else
+                               []
+                             end
+            scanned_hosts = capture(:sudo, '-u', postgres_user, 'ssh-keyscan', *peer_ips, raise_on_non_zero_exit: false)
+            known_hosts = (existing_hosts + scanned_hosts.lines.map(&:strip)).reject(&:empty?).uniq.join("\n")
+            unless known_hosts.empty?
+              upload! StringIO.new("#{known_hosts}\n"), '/tmp/pg_known_hosts'
+              execute :sudo, 'mv', '/tmp/pg_known_hosts', known_hosts_path
+              execute :sudo, 'chown', "#{postgres_user}:#{postgres_user}", known_hosts_path
+              execute :sudo, 'chmod', '600', known_hosts_path
+            end
           end
         end
       end
@@ -518,10 +538,21 @@ module ActivePostgres
           public_key = capture(:sudo, '-u', postgres_user, 'cat', "#{key_path}.pub").strip
 
           unless dns_servers.empty?
-            execute :sudo, '-u', postgres_user, 'touch', '/var/lib/postgresql/.ssh/known_hosts'
-            scan_cmd = "ssh-keyscan -H #{dns_servers.join(' ')} >> /var/lib/postgresql/.ssh/known_hosts 2>/dev/null || true"
-            execute :sudo, '-u', postgres_user, 'bash', '-c', scan_cmd
-            execute :sudo, '-u', postgres_user, 'chmod', '600', '/var/lib/postgresql/.ssh/known_hosts'
+            known_hosts_path = '/var/lib/postgresql/.ssh/known_hosts'
+            existing_hosts = if test(:sudo, 'test', '-f', known_hosts_path)
+                               capture(:sudo, 'cat', known_hosts_path).lines.map(&:strip)
+                             else
+                               []
+                             end
+            scanned_hosts = capture(:sudo, '-u', postgres_user, 'ssh-keyscan', '-H', *dns_servers,
+                                    raise_on_non_zero_exit: false)
+            known_hosts = (existing_hosts + scanned_hosts.lines.map(&:strip)).reject(&:empty?).uniq.join("\n")
+            unless known_hosts.empty?
+              upload! StringIO.new("#{known_hosts}\n"), '/tmp/pg_known_hosts'
+              execute :sudo, 'mv', '/tmp/pg_known_hosts', known_hosts_path
+              execute :sudo, 'chown', "#{postgres_user}:#{postgres_user}", known_hosts_path
+              execute :sudo, 'chmod', '600', known_hosts_path
+            end
           end
         end
 
@@ -542,8 +573,8 @@ module ActivePostgres
 
             upload! StringIO.new("#{key}\n"), '/tmp/active_postgres_dns_key.pub'
             execute :bash, '-c',
-                    "grep -qxF -f /tmp/active_postgres_dns_key.pub ~/.ssh/authorized_keys || " \
-                    "cat /tmp/active_postgres_dns_key.pub >> ~/.ssh/authorized_keys"
+                    'grep -qxF -f /tmp/active_postgres_dns_key.pub ~/.ssh/authorized_keys || ' \
+                    'cat /tmp/active_postgres_dns_key.pub >> ~/.ssh/authorized_keys'
             execute :rm, '-f', '/tmp/active_postgres_dns_key.pub'
           end
         end
@@ -560,11 +591,11 @@ module ActivePostgres
 
         domains = normalize_dns_domains(dns_config)
         primary_records = normalize_dns_records(dns_config[:primary_records] || dns_config[:primary_record],
-                                               default_prefix: 'db-primary',
-                                               domains: domains)
+                                                default_prefix: 'db-primary',
+                                                domains: domains)
         replica_records = normalize_dns_records(dns_config[:replica_records] || dns_config[:replica_record],
-                                               default_prefix: 'db-replica',
-                                               domains: domains)
+                                                default_prefix: 'db-replica',
+                                                domains: domains)
 
         _ = primary_records
         _ = replica_records
@@ -732,10 +763,10 @@ module ActivePostgres
             # Check replication status
             begin
               rep_status = executor.run_sql_on_backend(self,
-                                                      'SELECT pg_is_in_recovery();',
-                                                      postgres_user: postgres_user,
-                                                      tuples_only: true,
-                                                      capture: true).to_s
+                                                       'SELECT pg_is_in_recovery();',
+                                                       postgres_user: postgres_user,
+                                                       tuples_only: true,
+                                                       capture: true).to_s
               if rep_status.include?('t')
                 info '✓ Standby is in recovery mode (receiving replication)'
               else
@@ -750,10 +781,10 @@ module ActivePostgres
             # Check lag
             begin
               lag_result = executor.run_sql_on_backend(self,
-                                                      'SELECT EXTRACT(EPOCH FROM (now() - pg_last_xact_replay_timestamp()))::int AS lag;',
-                                                      postgres_user: postgres_user,
-                                                      tuples_only: true,
-                                                      capture: true).to_s.strip
+                                                       'SELECT EXTRACT(EPOCH FROM (now() - pg_last_xact_replay_timestamp()))::int AS lag;',
+                                                       postgres_user: postgres_user,
+                                                       tuples_only: true,
+                                                       capture: true).to_s.strip
               info "Replication lag: #{lag_result}"
             rescue StandardError => e
               error "Failed to get replication lag: #{e.message}"
@@ -785,7 +816,7 @@ module ActivePostgres
         # Create .pgpass file for postgres user to avoid password exposure in logs
         # Format: hostname:port:database:username:password
         pgpass_content = build_pgpass_content(host, repmgr_password, replication_password: replication_password,
-                                                                   primary_ip: primary_ip)
+                                                                     primary_ip: primary_ip)
 
         ssh_executor.execute_on_host(host) do
           # Create .pgpass in postgres user's home directory
@@ -854,8 +885,13 @@ module ActivePostgres
       def escape_pgpass_value(value)
         return '' if value.nil?
 
-        # Must escape backslashes first, then colons (order matters!)
-        value.to_s.gsub('\\', '\\\\\\\\').gsub(':', '\\:')
+        value.to_s.each_char.map do |char|
+          case char
+          when '\\' then '\\\\'
+          when ':' then '\\:'
+          else char
+          end
+        end.join
       end
 
       def build_primary_conninfo(standby_label)
@@ -935,12 +971,12 @@ module ActivePostgres
         ssh_executor.execute_on_host(host) do
           repmgr_sql = repmgr_component.send(:build_repmgr_setup_sql, repmgr_user, repmgr_db, repmgr_password)
           executor.run_sql_on_backend(self, repmgr_sql, postgres_user: 'postgres', port: 5432, tuples_only: false,
-                                           capture: false)
+                                                        capture: false)
 
           if replication_user != repmgr_user
             repl_sql = repmgr_component.send(:build_replication_user_sql, replication_user, effective_replication_password)
             executor.run_sql_on_backend(self, repl_sql, postgres_user: 'postgres', port: 5432, tuples_only: false,
-                                             capture: false)
+                                                        capture: false)
           end
 
           info '✓ Primary replication user is ready'

data/lib/active_postgres/configuration.rb

@@ -125,11 +125,10 @@ module ActivePostgres
       # Validate required secrets if components are enabled
       raise Error, 'Missing replication_password secret' if component_enabled?(:repmgr) && !secrets_config['replication_password']
       raise Error, 'Missing monitoring_password secret' if component_enabled?(:monitoring) && !secrets_config['monitoring_password']
+
       if component_enabled?(:monitoring)
         grafana_config = component_config(:monitoring)[:grafana] || {}
-        if grafana_config[:enabled] && !secrets_config['grafana_admin_password']
-          raise Error, 'Missing grafana_admin_password secret'
-        end
+        raise Error, 'Missing grafana_admin_password secret' if grafana_config[:enabled] && !secrets_config['grafana_admin_password']
         if grafana_config[:enabled] && grafana_config[:host].to_s.strip.empty?
           raise Error, 'monitoring.grafana.host is required when grafana is enabled'
         end
@@ -150,27 +149,27 @@ module ActivePostgres
         end
       end
 
-        if component_enabled?(:repmgr)
-          dns_failover = component_config(:repmgr)[:dns_failover]
-          if dns_failover && dns_failover[:enabled]
-            domains = Array(dns_failover[:domains] || dns_failover[:domain]).map(&:to_s).map(&:strip).reject(&:empty?)
-            servers = Array(dns_failover[:dns_servers])
-            provider = (dns_failover[:provider] || 'dnsmasq').to_s.strip
-
-            raise Error, 'dns_failover.domain or dns_failover.domains is required when enabled' if domains.empty?
-            raise Error, 'dns_failover.dns_servers is required when enabled' if servers.empty?
-            raise Error, "Unsupported dns_failover provider '#{provider}'" unless provider == 'dnsmasq'
-
-            servers.each do |server|
-              next unless server.is_a?(Hash)
-
-              ssh_host = server['ssh_host'] || server[:ssh_host] || server['host'] || server[:host]
-              private_ip = server['private_ip'] || server[:private_ip] || server['ip'] || server[:ip]
-              raise Error, 'dns_failover.dns_servers entries must include host/ssh_host or private_ip' if
-                (ssh_host.nil? || ssh_host.to_s.strip.empty?) && (private_ip.nil? || private_ip.to_s.strip.empty?)
-            end
+      if component_enabled?(:repmgr)
+        dns_failover = component_config(:repmgr)[:dns_failover]
+        if dns_failover && dns_failover[:enabled]
+          domains = Array(dns_failover[:domains] || dns_failover[:domain]).map(&:to_s).map(&:strip).reject(&:empty?)
+          servers = Array(dns_failover[:dns_servers])
+          provider = (dns_failover[:provider] || 'dnsmasq').to_s.strip
+
+          raise Error, 'dns_failover.domain or dns_failover.domains is required when enabled' if domains.empty?
+          raise Error, 'dns_failover.dns_servers is required when enabled' if servers.empty?
+          raise Error, "Unsupported dns_failover provider '#{provider}'" unless provider == 'dnsmasq'
+
+          servers.each do |server|
+            next unless server.is_a?(Hash)
+
+            ssh_host = server['ssh_host'] || server[:ssh_host] || server['host'] || server[:host]
+            private_ip = server['private_ip'] || server[:private_ip] || server['ip'] || server[:ip]
+            raise Error, 'dns_failover.dns_servers entries must include host/ssh_host or private_ip' if
+              (ssh_host.nil? || ssh_host.to_s.strip.empty?) && (private_ip.nil? || private_ip.to_s.strip.empty?)
           end
         end
+      end
 
       true
     end

data/lib/active_postgres/direct_executor.rb

@@ -62,19 +62,13 @@ module ActivePostgres
       return nil if value.nil?
 
       # Handle Rails credentials
-      if value.start_with?('rails_credentials:')
-        return resolve_rails_credentials(value)
-      end
+      return resolve_rails_credentials(value) if value.start_with?('rails_credentials:')
 
       # Handle environment variables
-      if value.start_with?('$')
-        return ENV[value[1..]]
-      end
+      return ENV.fetch(value[1..], nil) if value.start_with?('$')
 
       # Handle shell commands
-      if value.start_with?('$(') && value.end_with?(')')
-        return `#{value[2..-2]}`.strip
-      end
+      return `#{value[2..-2]}`.strip if value.start_with?('$(') && value.end_with?(')')
 
       value
     end

data/lib/active_postgres/error_handler.rb

@@ -127,24 +127,24 @@ module ActivePostgres
 
       # Identify error type from error message
       def identify_error_type(message)
-        case message.downcase
-        when /ssh|connection refused|network unreachable/
-          :ssh_connection
-        when /private network|vpn|wireguard network/
-          :private_network_connectivity
-        when /postgresql.*not.*start|cluster.*not.*running/
-          :postgresql_not_starting
-        when /repmgr.*clone|data directory/
-          :repmgr_clone_failed
-        when /repmgr.*register|unable to connect to.*primary/
-          :repmgr_register_failed
-        when /ssl|certificate|tls/
-          :ssl_certificate_error
-        when /no space|disk full/
-          :disk_space_error
-        when /authentication|password|pg_hba/
-          :authentication_failed
-        end
+        normalized = message.to_s.downcase
+
+        return :ssh_connection if contains_any?(normalized, 'ssh', 'connection refused', 'network unreachable')
+        return :private_network_connectivity if contains_any?(normalized, 'private network', 'vpn', 'wireguard network')
+        return :postgresql_not_starting if normalized.include?('postgresql') && normalized.include?('not') && normalized.include?('start')
+        return :postgresql_not_starting if normalized.include?('cluster') && normalized.include?('not') && normalized.include?('running')
+        return :repmgr_clone_failed if normalized.include?('repmgr') && normalized.include?('clone')
+        return :repmgr_clone_failed if normalized.include?('data directory')
+        return :repmgr_register_failed if normalized.include?('repmgr') && normalized.include?('register')
+        return :repmgr_register_failed if normalized.include?('unable to connect to') && normalized.include?('primary')
+        return :ssl_certificate_error if contains_any?(normalized, 'ssl', 'certificate', 'tls')
+        return :disk_space_error if contains_any?(normalized, 'no space', 'disk full')
+
+        :authentication_failed if contains_any?(normalized, 'authentication', 'password', 'pg_hba')
+      end
+
+      def contains_any?(value, *needles)
+        needles.any? { |needle| value.include?(needle) }
       end
 
       # Show troubleshooting guide for a specific error type

data/lib/active_postgres/health_checker.rb

@@ -12,14 +12,6 @@ module ActivePostgres
       @executor
     end
 
-    private def create_executor
-      if use_ssh_executor?
-        SSHExecutor.new(config, quiet: true)
-      else
-        DirectExecutor.new(config, quiet: true)
-      end
-    end
-
     def use_ssh_executor?
       mode = ENV['ACTIVE_POSTGRES_STATUS_MODE'].to_s.strip.downcase
       return true if mode == 'ssh'
@@ -131,6 +123,14 @@ module ActivePostgres
 
     private
 
+    def create_executor
+      if use_ssh_executor?
+        SSHExecutor.new(config, quiet: true)
+      else
+        DirectExecutor.new(config, quiet: true)
+      end
+    end
+
     def collect_node_status
       nodes = []
 
@@ -184,9 +184,7 @@ module ActivePostgres
         lag: [3, nodes.map { |n| n[:lag].to_s.length }.max].max
       }
 
-      if config.component_enabled?(:pgbouncer)
-        cols[:pgbouncer] = [9, nodes.map { |n| n[:pgbouncer].to_s.length }.max].max
-      end
+      cols[:pgbouncer] = [9, nodes.map { |n| n[:pgbouncer].to_s.length }.max].max if config.component_enabled?(:pgbouncer)
 
       cols
     end
@@ -194,7 +192,7 @@ module ActivePostgres
     def print_table_header(cols)
       fmt = "%-#{cols[:role]}s  %-#{cols[:host]}s  %-#{cols[:private_ip]}s  " \
             "%-#{cols[:label]}s  %-#{cols[:status]}s  %#{cols[:conn]}s  %#{cols[:lag]}s"
-      headers = %w[Role Host Private\ IP Label Status Conn Lag]
+      headers = ['Role', 'Host', 'Private IP', 'Label', 'Status', 'Conn', 'Lag']
 
       if cols[:pgbouncer]
         fmt += "  %-#{cols[:pgbouncer]}s"

data/lib/active_postgres/overview.rb

@@ -61,14 +61,14 @@ module ActivePostgres
         label = config.node_label_for(host)
         stats = fetch_system_stats(host, paths)
         if stats.nil?
-          puts "  #{host}#{label ? " (#{label})" : ''}: unavailable"
+          puts "  #{host}#{" (#{label})" if label}: unavailable"
           next
         end
 
         mem_used_kb = stats[:mem_total_kb] - stats[:mem_avail_kb]
         mem_pct = stats[:mem_total_kb].positive? ? (mem_used_kb.to_f / stats[:mem_total_kb] * 100).round : 0
 
-        puts "  #{host}#{label ? " (#{label})" : ''}: load #{stats[:loadavg]} | cpu #{stats[:cpu]}% | " \
+        puts "  #{host}#{" (#{label})" if label}: load #{stats[:loadavg]} | cpu #{stats[:cpu]}% | " \
              "mem #{format_kb(mem_used_kb)}/#{format_kb(stats[:mem_total_kb])} (#{mem_pct}%)"
 
         stats[:disks].each do |disk|
@@ -227,7 +227,7 @@ module ActivePostgres
       with_timeout("system stats #{host}") do
         ssh_executor = executor
         safe_paths = paths.map { |p| Shellwords.escape(p) }.join(' ')
-        script = <<~'BASH'
+        script = <<~BASH
           set -e
           loadavg=$(cut -d' ' -f1-3 /proc/loadavg)
 
@@ -256,7 +256,7 @@ module ActivePostgres
 
         ssh_executor.execute_on_host(host) do
           output = capture(:bash, '-lc', "#{script}\n df -kP #{safe_paths} 2>/dev/null | tail -n +2 | " \
-                                        "awk '{print \"disk=\" $6 \"|\" $2 \"|\" $3 \"|\" $4 \"|\" $5}'",
+                                         "awk '{print \"disk=\" $6 \"|\" $2 \"|\" $3 \"|\" $4 \"|\" $5}'",
                            raise_on_non_zero_exit: false).to_s
         end
       end
@@ -299,12 +299,12 @@ module ActivePostgres
       stats
     end
 
-    def format_kb(kb)
-      kb = kb.to_f
-      gb = kb / 1024 / 1024
+    def format_kb(kilobytes)
+      kilobytes = kilobytes.to_f
+      gb = kilobytes / 1024 / 1024
       return format('%.1fG', gb) if gb >= 1
 
-      mb = kb / 1024
+      mb = kilobytes / 1024
       format('%.0fM', mb)
     end
 
@@ -342,8 +342,8 @@ module ActivePostgres
       value.positive? ? value : DEFAULT_TIMEOUT
     end
 
-    def with_timeout(label)
-      Timeout.timeout(overview_timeout) { yield }
+    def with_timeout(label, &)
+      Timeout.timeout(overview_timeout, &)
     rescue Timeout::Error
       raise StandardError, "#{label} timed out after #{overview_timeout}s"
     end

data/lib/active_postgres/secrets.rb

@@ -20,8 +20,8 @@ module ActivePostgres
     end
 
     def resolve_all
-      config.secrets_config.keys.each_with_object({}) do |key, result|
-        result[key] = resolve(key)
+      config.secrets_config.keys.to_h do |key|
+        [key, resolve(key)]
       end
     end
 
@@ -47,8 +47,9 @@ module ActivePostgres
 
       resolve_all.each do |key, value|
         file_path = File.join(directory, key)
-        File.write(file_path, value)
-        File.chmod(0o600, file_path)
+        File.open(file_path, File::WRONLY | File::CREAT | File::TRUNC, 0o600) do |file|
+          file.write(value)
+        end
         puts "Cached #{key} to #{file_path}"
       end
 
@@ -101,9 +102,7 @@ module ActivePostgres
 
       # Try loading just the Rails application (without full initialization)
       # This makes Rails.application available for credential access
-      if File.exist?('./config/application.rb')
-        require './config/application'
-      end
+      require './config/application' if File.exist?('./config/application.rb')
     rescue StandardError
       # Rails boot failed — CLI running outside a Rails project
       nil

data/lib/active_postgres/ssh_executor.rb

@@ -215,11 +215,11 @@ module ActivePostgres
       execute_on_host(host) do
         backend = self
         result = executor.run_sql_on_backend(backend, sql,
-                                    postgres_user: postgres_user,
-                                    port: port,
-                                    database: database,
-                                    tuples_only: tuples_only,
-                                    capture: capture)
+                                             postgres_user: postgres_user,
+                                             port: port,
+                                             database: database,
+                                             tuples_only: tuples_only,
+                                             capture: capture)
       end
       result
     end

data/lib/active_postgres/version.rb

@@ -1,3 +1,3 @@
 module ActivePostgres
-  VERSION = '0.9.5'.freeze
+  VERSION = '0.9.6'.freeze
 end

data/lib/tasks/postgres.rake

@@ -287,39 +287,39 @@ namespace :postgres do
     puts "\nTip: set RAILS_ENV=production for production targets"
 
     puts "\nSetup & Maintenance"
-    puts "  rake postgres:setup                  # Deploy HA cluster (CLEAN=true for fresh install)"
-    puts "  rake postgres:purge                  # Destroy cluster (DESTRUCTIVE)"
-    puts "  rake postgres:setup:core             # PostgreSQL config (postgresql.conf, pg_hba.conf)"
-    puts "  rake postgres:setup:repmgr           # HA + failover (repmgr)"
-    puts "  rake postgres:setup:pgbouncer        # PgBouncer pooling"
-    puts "  rake postgres:setup:pgbackrest       # Backups (pgBackRest)"
-    puts "  rake postgres:setup:monitoring       # postgres_exporter"
-    puts "  rake postgres:setup:ssl              # SSL certs"
+    puts '  rake postgres:setup                  # Deploy HA cluster (CLEAN=true for fresh install)'
+    puts '  rake postgres:purge                  # Destroy cluster (DESTRUCTIVE)'
+    puts '  rake postgres:setup:core             # PostgreSQL config (postgresql.conf, pg_hba.conf)'
+    puts '  rake postgres:setup:repmgr           # HA + failover (repmgr)'
+    puts '  rake postgres:setup:pgbouncer        # PgBouncer pooling'
+    puts '  rake postgres:setup:pgbackrest       # Backups (pgBackRest)'
+    puts '  rake postgres:setup:monitoring       # postgres_exporter'
+    puts '  rake postgres:setup:ssl              # SSL certs'
 
     puts "\nStatus & Health"
-    puts "  rake postgres:status                 # Cluster status (SSH by default)"
-    puts "  rake postgres:overview               # Control tower overview"
-    puts "  rake postgres:nodes                  # Topology view"
-    puts "  rake postgres:verify                 # Comprehensive checklist"
-    puts "  ACTIVE_POSTGRES_STATUS_MODE=ssh|direct rake postgres:status"
+    puts '  rake postgres:status                 # Cluster status (SSH by default)'
+    puts '  rake postgres:overview               # Control tower overview'
+    puts '  rake postgres:nodes                  # Topology view'
+    puts '  rake postgres:verify                 # Comprehensive checklist'
+    puts '  ACTIVE_POSTGRES_STATUS_MODE=ssh|direct rake postgres:status'
 
     puts "\nBackups"
-    puts "  rake postgres:backup:full            # Full backup"
-    puts "  rake postgres:backup:incremental     # Incremental backup"
-    puts "  rake postgres:backup:list            # List backups"
-    puts "  rake postgres:backup:restore[ID]     # Restore backup set"
-    puts "  rake postgres:backup:restore_at[\"YYYY-MM-DD HH:MM:SS\",promote]  # PITR"
+    puts '  rake postgres:backup:full            # Full backup'
+    puts '  rake postgres:backup:incremental     # Incremental backup'
+    puts '  rake postgres:backup:list            # List backups'
+    puts '  rake postgres:backup:restore[ID]     # Restore backup set'
+    puts '  rake postgres:backup:restore_at["YYYY-MM-DD HH:MM:SS",promote]  # PITR'
 
     puts "\nMigrations"
-    puts "  rake postgres:migrate                # Run migrations on primary only"
+    puts '  rake postgres:migrate                # Run migrations on primary only'
 
     puts "\nPgBouncer"
-    puts "  rake postgres:pgbouncer:update_userlist[users]  # Update userlist"
-    puts "  rake postgres:pgbouncer:stats        # Service status + stats"
+    puts '  rake postgres:pgbouncer:update_userlist[users]  # Update userlist'
+    puts '  rake postgres:pgbouncer:stats        # Service status + stats'
 
     puts "\nTests"
-    puts "  rake postgres:test:replication[rows] # Replication stress test"
-    puts "  rake postgres:test:pgbouncer[connections]  # PgBouncer load test"
+    puts '  rake postgres:test:replication[rows] # Replication stress test'
+    puts '  rake postgres:test:pgbouncer[connections]  # PgBouncer load test'
 
     puts
   end
@@ -380,7 +380,7 @@ namespace :postgres do
     end
 
     desc 'Restore to a point in time (PITR)'
-    task :restore_at, [:target_time, :target_action] => :environment do |_t, args|
+    task :restore_at, %i[target_time target_action] => :environment do |_t, args|
       require 'active_postgres'
 
       unless args[:target_time]
@@ -607,8 +607,8 @@ namespace :postgres do
               nil
             end
             if cert_issuer
-              issuer_o = cert_issuer.match(/O\s*=\s*"?([^",\/]+)"?/)&.captures&.first
-              issuer_cn = cert_issuer.match(/CN\s*=\s*([^,\/]+)/)&.captures&.first
+              issuer_o = cert_issuer.match(%r{O\s*=\s*"?([^",/]+)"?})&.captures&.first
+              issuer_cn = cert_issuer.match(%r{CN\s*=\s*([^,/]+)})&.captures&.first
               issuer_name = issuer_o || issuer_cn || cert_issuer.sub('issuer=', '')
               info "   Issuer: #{issuer_name.strip}"
             end

data/templates/postgresql.conf.erb

@@ -52,6 +52,11 @@ archive_command = '<%= pg_config[:archive_command] %>'
 <% elsif config.component_enabled?(:pgbackrest) %>
 archive_command = 'pgbackrest --stanza=main archive-push %p'
 <% end %>
+<% if pg_config[:restore_command] %>
+restore_command = '<%= pg_config[:restore_command] %>'
+<% elsif config.component_enabled?(:pgbackrest) %>
+restore_command = 'pgbackrest --pg1-path=/var/lib/postgresql/<%= config.version %>/main --stanza=main archive-get %f "%p"'
+<% end %>
 <% if pg_config[:shared_memory_type] %>
 shared_memory_type = <%= pg_config[:shared_memory_type] %>
 <% end %>

data/templates/repmgr_dns_failover.sh.erb

@@ -17,13 +17,13 @@ REPMGR_DB=$(grep -oP "dbname=\K[^ ']+" "$REPMGR_CONF" | head -1)
 REPMGR_USER=$(grep -oP "user=\K[^ ']+" "$REPMGR_CONF" 2>/dev/null | head -1)
 REPMGR_USER="${REPMGR_USER:-repmgr}"
 
-cluster_data=$(psql -h /var/run/postgresql -d "$REPMGR_DB" -tAF',' -c "SELECT type, conninfo FROM repmgr.nodes WHERE active = true" 2>/dev/null || true)
+cluster_data=$(psql -h /var/run/postgresql -d "$REPMGR_DB" -tAF',' -c "SELECT type, conninfo FROM repmgr.nodes WHERE active = true ORDER BY node_id" 2>/dev/null || true)
 if [[ -z "$cluster_data" ]]; then
   exit 0
 fi
 
 primary_host=$(printf "%s\n" "$cluster_data" | awk -F',' '$1 == "primary" {print $2; exit}' | sed -n 's/.*host=\([^ ]*\).*/\1/p')
-standby_hosts=$(printf "%s\n" "$cluster_data" | awk -F',' '$1 == "standby" {print $2}' | sed -n 's/.*host=\([^ ]*\).*/\1/p' | sort -u)
+standby_hosts=$(printf "%s\n" "$cluster_data" | awk -F',' '$1 == "standby" {print $2; exit}' | sed -n 's/.*host=\([^ ]*\).*/\1/p')
 
 if [[ -z "$primary_host" ]]; then
   exit 0

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: active_postgres
 version: !ruby/object:Gem::Version
-  version: 0.9.5
+  version: 0.9.6
 platform: ruby
 authors:
 - BoringCache
@@ -29,35 +29,35 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '1.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '1.4'
 - !ruby/object:Gem::Dependency
   name: pg
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '1.6'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '1.6'
 - !ruby/object:Gem::Dependency
   name: railties
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '6.0'
+        version: '8.1'
     - - "<"
       - !ruby/object:Gem::Version
         version: '9.0'
@@ -67,7 +67,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '6.0'
+        version: '8.1'
     - - "<"
       - !ruby/object:Gem::Version
         version: '9.0'
@@ -77,70 +77,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.21'
+        version: '1.25'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.21'
+        version: '1.25'
 - !ruby/object:Gem::Dependency
   name: thor
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '1.5'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
-- !ruby/object:Gem::Dependency
-  name: minitest
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '5.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '5.0'
-- !ruby/object:Gem::Dependency
-  name: rubocop
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.50'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.50'
-- !ruby/object:Gem::Dependency
-  name: simplecov
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.22'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.5'
 description: Production-grade PostgreSQL HA with deep Rails integration. Automated
   deployment, replication, failover, and monitoring.
 email:
@@ -150,8 +108,10 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
+- CHANGELOG.md
 - LICENSE
 - README.md
+- SECURITY.md
 - exe/activepostgres
 - lib/active_postgres.rb
 - lib/active_postgres/cli.rb
@@ -209,10 +169,10 @@ homepage: https://github.com/boringcache/active_postgres
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://github.com/boringcache/active_postgres
   source_code_uri: https://github.com/boringcache/active_postgres
   documentation_uri: https://github.com/boringcache/active_postgres/blob/main/README.md
   changelog_uri: https://github.com/boringcache/active_postgres/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/boringcache/active_postgres/issues
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
@@ -221,14 +181,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.3.0
+      version: 4.0.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.16
 specification_version: 4
 summary: PostgreSQL High Availability for Rails, made simple
 test_files: []