mirror of
https://github.com/neondatabase/neon.git
synced 2026-01-03 19:42:55 +00:00
3dec117572
Closes: https://github.com/neondatabase/cloud/issues/22998 If control-plane reports that TLS should be used, load the certificates (and watch for updates), make sure postgres use them, and detects updates. Procedure: 1. Load certificates 2. Reconfigure postgres/pgbouncer 3. Loop on a timer until certificates have loaded 4. Go to 1 Notes: 1. We only run this procedure if requested on startup by control plane. 2. We needed to compile pgbouncer with openssl enabled 3. Postgres doesn't allow tls keys to be globally accessible - must be read only to the postgres user. I couldn't convince the autoscaling team to let me put this logic into the VM settings, so instead compute_ctl will copy the keys to be read-only by postgres. 4. To mitigate a race condition, we also verify that the key matches the cert.
18 lines
382 B
TOML
18 lines
382 B
TOML
[package]
|
|
name = "compute_api"
|
|
version = "0.1.0"
|
|
edition = "2024"
|
|
license.workspace = true
|
|
|
|
[dependencies]
|
|
anyhow.workspace = true
|
|
chrono.workspace = true
|
|
indexmap.workspace = true
|
|
jsonwebtoken.workspace = true
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
regex.workspace = true
|
|
|
|
utils = { path = "../utils" }
|
|
remote_storage = { version = "0.1", path = "../remote_storage/" }
|