mirror of
https://github.com/neondatabase/neon.git
synced 2026-01-05 20:42:54 +00:00
3dec117572
Closes: https://github.com/neondatabase/cloud/issues/22998 If control-plane reports that TLS should be used, load the certificates (and watch for updates), make sure postgres use them, and detects updates. Procedure: 1. Load certificates 2. Reconfigure postgres/pgbouncer 3. Loop on a timer until certificates have loaded 4. Go to 1 Notes: 1. We only run this procedure if requested on startup by control plane. 2. We needed to compile pgbouncer with openssl enabled 3. Postgres doesn't allow tls keys to be globally accessible - must be read only to the postgres user. I couldn't convince the autoscaling team to let me put this logic into the VM settings, so instead compute_ctl will copy the keys to be read-only by postgres. 4. To mitigate a race condition, we also verify that the key matches the cert.
76 lines
2.0 KiB
TOML
76 lines
2.0 KiB
TOML
[package]
|
|
name = "compute_tools"
|
|
version = "0.1.0"
|
|
edition = "2024"
|
|
license.workspace = true
|
|
|
|
[features]
|
|
default = []
|
|
# Enables test specific features.
|
|
testing = ["fail/failpoints"]
|
|
|
|
[dependencies]
|
|
base64.workspace = true
|
|
aws-config.workspace = true
|
|
aws-sdk-s3.workspace = true
|
|
aws-sdk-kms.workspace = true
|
|
aws-smithy-types.workspace = true
|
|
anyhow.workspace = true
|
|
axum = { workspace = true, features = [] }
|
|
axum-extra.workspace = true
|
|
camino.workspace = true
|
|
chrono.workspace = true
|
|
cfg-if.workspace = true
|
|
clap.workspace = true
|
|
fail.workspace = true
|
|
flate2.workspace = true
|
|
futures.workspace = true
|
|
http.workspace = true
|
|
indexmap.workspace = true
|
|
jsonwebtoken.workspace = true
|
|
metrics.workspace = true
|
|
nix.workspace = true
|
|
notify.workspace = true
|
|
num_cpus.workspace = true
|
|
once_cell.workspace = true
|
|
opentelemetry.workspace = true
|
|
opentelemetry_sdk.workspace = true
|
|
p256 = { version = "0.13", features = ["pem"] }
|
|
postgres.workspace = true
|
|
regex.workspace = true
|
|
reqwest = { workspace = true, features = ["json"] }
|
|
ring = "0.17"
|
|
serde.workspace = true
|
|
serde_with.workspace = true
|
|
serde_json.workspace = true
|
|
signal-hook.workspace = true
|
|
spki = { version = "0.7.3", features = ["std"] }
|
|
tar.workspace = true
|
|
tower.workspace = true
|
|
tower-http.workspace = true
|
|
tokio = { workspace = true, features = ["rt", "rt-multi-thread"] }
|
|
tokio-postgres.workspace = true
|
|
tokio-util.workspace = true
|
|
tokio-stream.workspace = true
|
|
tower-otel.workspace = true
|
|
tracing.workspace = true
|
|
tracing-opentelemetry.workspace = true
|
|
tracing-subscriber.workspace = true
|
|
tracing-utils.workspace = true
|
|
thiserror.workspace = true
|
|
url.workspace = true
|
|
uuid.workspace = true
|
|
walkdir.workspace = true
|
|
x509-cert = { version = "0.2.5" }
|
|
|
|
postgres_initdb.workspace = true
|
|
compute_api.workspace = true
|
|
utils.workspace = true
|
|
workspace_hack.workspace = true
|
|
remote_storage = { version = "0.1", path = "../libs/remote_storage/" }
|
|
vm_monitor = { version = "0.1", path = "../libs/vm_monitor/" }
|
|
zstd = "0.13"
|
|
bytes = "1.0"
|
|
rust-ini = "0.20.0"
|
|
rlimit = "0.10.1"
|