mirror of
https://github.com/neondatabase/neon.git
synced 2026-01-14 17:02:56 +00:00
5e972ccdc4
- Use postgres_backend_async throughout safekeeper. - Use Framed in postgres_backend_async, it allows polling interface and takes some logic. - Do read-write from single task in walsender. The latter turned out to be more complicated than I initially expected due to 1) borrow checking and 2) anon Future types. 1) required SendRc<Refcell<...>> construct just to satisfy the checker; 2) is currently done via boxing futures, which is a pointless heap allocation in active path. I'll probably try to workaround 2) with transmute, but it made me wonder whether socket split, like it was done previously, would be better. It is also messy though: - we need to manage two tasks, properly join them and should on exit/error should join pgbackend back to leave it in valid state; pgbackend itself must swell a bit to provide splitted interface. - issues with tls - tokio::io::split has pointless mutex inside fixing walreceiver and proxy is not done yet
Proxy
Proxy binary accepts --auth-backend CLI option, which determines auth scheme and cluster routing method. Following backends are currently implemented:
- console new SCRAM-based console API; uses SNI info to select the destination project (endpoint soon)
- postgres uses postgres to select auth secrets of existing roles. Useful for local testing
- link sends login link for all usernames
Using SNI-based routing on localhost
Now proxy determines project name from the subdomain, request to the round-rice-566201.somedomain.tld will be routed to the project named round-rice-566201. Unfortunately, /etc/hosts does not support domain wildcards, so I usually use *.localtest.me which resolves to 127.0.0.1. Now we can create self-signed certificate and play with proxy:
openssl req -new -x509 -days 365 -nodes -text -out server.crt -keyout server.key -subj "/CN=*.localtest.me"
start proxy
./target/debug/proxy -c server.crt -k server.key
and connect to it
PGSSLROOTCERT=./server.crt psql 'postgres://my-cluster-42.localtest.me:1234?sslmode=verify-full'