HAULDR-8: o envelope do perfil chega no PostgREST, e nessa ordem

PGRST_DB_POOL nunca foi setado — em lugar nenhum do repo. Todo sidecar rest
roda o default do PostgREST (pool 10) e, medido na frota, pica em 11 backends
com a conexão de LISTEN. O poolSize do perfil só era escrito no Supavisor, que
só governa os 8 sidecars roteados por ele; os outros 20 vão direto ao Postgres,
onde o único knob que sobra é o CONNECTION LIMIT do role.

O Nano limita em 8. 8 < 11 ⇒ o role não throttla, ele RECUSA: aplicando o
envelope Nano no logcheck_dev, 8 de 40 requisições viraram 503. Ou seja, "dev
nasce nano" (HAULDR-6) embarcou um 503 latente — não mordeu só porque nenhum
projeto foi rebaixado ainda.

provisionRest passa a derivar PGRST_DB_POOL do perfil do projeto, que é o
número que o poolSize sempre quis dizer. Com isso pool+LISTEN cabe folgado em
todos os envelopes: nano 2+1<8, micro 5+1<20, small 10+1<40.

setProjectProfile passa a propagar o pool pro sidecar, e a ORDEM é a correção:
teto e pool empurram um contra o outro, então encolhe o pool antes de baixar o
teto, e sobe o teto antes de crescer o pool. Ao encolher, falhar aborta antes
de baixar o teto (teto velho é seguro); ao crescer, falhar só deixa o pool
menor que o permitido (conservador).

⚠️ Os sidecars já provisionados seguem com o default 10 até o próximo
provision — seguros (11 < 20 do micro), mas ainda desonestos.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: valvesss

control-plane/src/coolify.ts

@@ -312,6 +312,7 @@ export async function coolifyProvisionRest(
   base: string,
   environment: string,
   publicDataPlane = false,
+  dbPool = 10,
 ): Promise<CoolifyRestEndpoint> {
   const { domain: restUrl, domains } = await ensureEndpoint(
     base,
@@ -341,6 +342,12 @@ export async function coolifyProvisionRest(
     PGRST_SERVER_PORT: "3000",
     // The public URL, so the served OpenAPI advertises the right base.
     PGRST_OPENAPI_SERVER_PROXY_URI: restUrl,
+    // The profile's envelope, applied where it actually binds. Left unset,
+    // PostgREST defaults to a pool of 10 and (measured) peaks at 11 backends
+    // with the LISTEN connection — over Nano's connection limit of 8, so the
+    // role refuses and requests 503. Supavisor only bounds the sidecars routed
+    // through it; most go direct, where this is the sole enforcement point.
+    PGRST_DB_POOL: String(dbPool),
   };
   await setEnvs(appUuid, env);
   await deployApp(appUuid);

control-plane/src/postgrest.ts

@@ -6,6 +6,7 @@ import { clusterOf, dbHostForCluster, dbPortForCluster, type Cluster } from "./c
 import { coolifyProvisionRest, coolifyDestroyRest } from "./coolify";
 import { projectIdentity } from "./gotrue";
 import { resolveSidecarBaseUrl } from "./sidecar";
+import { DEFAULT_PROFILE, envelope, isProjectProfile } from "./profiles";
 
 const exec = promisify(execFile);
 
@@ -43,14 +44,20 @@ function restDbUri(
  */
 async function prepareRest(
   name: string,
-): Promise<{ database: string; dbUri: string; jwtSecret: string }> {
+): Promise<{ database: string; dbUri: string; jwtSecret: string; dbPool: number }> {
   const cluster = await clusterOf(name);
   const { rows } = await controlPool.query(
-    "select database, role, db_password, jwt_secret from projects where name = $1",
+    "select database, role, db_password, jwt_secret, profile from projects where name = $1",
     [name],
   );
   const row = rows[0] as
-    | { database: string; role: string; db_password: string | null; jwt_secret: string | null }
+    | {
+        database: string;
+        role: string;
+        db_password: string | null;
+        jwt_secret: string | null;
+        profile: string | null;
+      }
     | undefined;
   if (!row) throw new Error(`project '${name}' does not exist`);
   if (!row.db_password) throw new Error(`project '${name}' has no stored db password — re-provision it`);
@@ -59,10 +66,12 @@ async function prepareRest(
       `project '${name}' has no JWT secret — provision auth (GoTrue) before REST`,
     );
   }
+  const profile = isProjectProfile(row.profile) ? row.profile : DEFAULT_PROFILE;
   return {
     database: row.database,
     dbUri: restDbUri(row.database, row.role, row.db_password, cluster),
     jwtSecret: row.jwt_secret,
+    dbPool: envelope(profile).poolSize,
   };
 }
 
@@ -76,14 +85,14 @@ async function prepareRest(
  * run and route it. Idempotent on the app/container.
  */
 export async function provisionRest(name: string): Promise<ProjectRest> {
-  const { dbUri, jwtSecret } = await prepareRest(name);
+  const { dbUri, jwtSecret, dbPool } = await prepareRest(name);
 
   let endpoint: ProjectRest;
   if (config.restProvisioner === "coolify") {
     const { base, env, publicDataPlane } = await projectIdentity(name);
-    endpoint = await coolifyProvisionRest(name, dbUri, jwtSecret, base, env, publicDataPlane);
+    endpoint = await coolifyProvisionRest(name, dbUri, jwtSecret, base, env, publicDataPlane, dbPool);
   } else {
-    endpoint = await dockerProvisionRest(name, dbUri, jwtSecret);
+    endpoint = await dockerProvisionRest(name, dbUri, jwtSecret, dbPool);
   }
 
   await controlPool.query(
@@ -124,6 +133,7 @@ async function dockerProvisionRest(
   name: string,
   dbUri: string,
   jwtSecret: string,
+  dbPool: number,
 ): Promise<ProjectRest> {
   const container = `hauldr-rest-${name}`;
   await docker(["rm", "-f", container]).catch(() => {});
@@ -139,6 +149,7 @@ async function dockerProvisionRest(
     "-e", "PGRST_JWT_AUD=authenticated",
     "-e", "PGRST_DB_USE_LEGACY_GUCS=false",
     "-e", "PGRST_SERVER_PORT=3000",
+    "-e", `PGRST_DB_POOL=${dbPool}`,
     config.restImage,
   ]);
 

control-plane/src/profileapi.ts

@@ -13,6 +13,7 @@ import {
   poolerEnabled,
   registerTenant,
 } from "./supavisor";
+import { provisionRest } from "./postgrest";
 
 function ident(s: string) {
   if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(s)) throw new Error(`bad ident: ${s}`);
@@ -23,8 +24,15 @@ function lit(s: string) {
 }
 
 /**
- * Apply a profile envelope to the project's authenticator role + Supavisor
- * pool_size, and persist `projects.profile`. Idempotent.
+ * Apply a profile envelope to the project's authenticator role, its PostgREST
+ * pool and the Supavisor pool_size, and persist `projects.profile`. Idempotent.
+ *
+ * The envelope has two halves that push against each other: the role's
+ * CONNECTION LIMIT is a ceiling, and the sidecar's pool is what climbs it. They
+ * must never cross — a pool above the ceiling doesn't get throttled, it gets
+ * REFUSED, and the lane serves 503s. So the order below is load-bearing:
+ * shrink the pool before lowering the ceiling, raise the ceiling before growing
+ * the pool. Same reason a gate's two halves can't land apart.
  */
 export async function setProjectProfile(
   name: string,
@@ -33,7 +41,8 @@ export async function setProjectProfile(
   if (!isProjectProfile(profile)) throw new Error(`invalid profile: ${profile}`);
 
   const { rows } = await controlPool.query(
-    `select name, role, database, db_password, tenant_external_id, profile
+    `select name, role, database, db_password, tenant_external_id, profile,
+            postgrest_url, rest_requested
        from projects where name = $1`,
     [name],
   );
@@ -45,11 +54,28 @@ export async function setProjectProfile(
         db_password: string | null;
         tenant_external_id: string | null;
         profile: string;
+        postgrest_url: string | null;
+        rest_requested: boolean | null;
       }
     | undefined;
   if (!r) throw new Error(`project not found: ${name}`);
 
   const env = envelope(profile);
+  const previous = isProjectProfile(r.profile) ? r.profile : DEFAULT_PROFILE;
+  const shrinking = env.connectionLimit < envelope(previous).connectionLimit;
+  const hasRest = !!(r.postgrest_url || r.rest_requested);
+
+  // Persist first: provisionRest sizes PGRST_DB_POOL off this row.
+  await controlPool.query(
+    "update projects set profile = $2 where name = $1",
+    [name, profile],
+  );
+
+  // Shrinking: the pool has to come down FIRST, and a failure here must abort
+  // before the ceiling drops — leaving the old (higher) ceiling is safe, the
+  // reverse is an outage.
+  if (shrinking && hasRest) await provisionRest(name);
+
   const cluster = await clusterOf(name);
   const admin = adminClientForCluster(cluster);
   await admin.connect();
@@ -67,6 +93,14 @@ export async function setProjectProfile(
     await admin.end();
   }
 
+  // Growing: ceiling is already up, so the pool can follow. A failure here only
+  // leaves the pool smaller than the envelope allows — conservative, not broken.
+  if (!shrinking && hasRest) {
+    await provisionRest(name).catch((e) => {
+      console.warn(`[profile] ${name}: pool not resized to ${env.poolSize}: ${e}`);
+    });
+  }
+
   if (poolerEnabled() && r.db_password && r.tenant_external_id) {
     await registerTenant({
       externalId: r.tenant_external_id,
@@ -78,10 +112,6 @@ export async function setProjectProfile(
     });
   }
 
-  await controlPool.query(
-    "update projects set profile = $2 where name = $1",
-    [name, profile],
-  );
   return { name, profile };
 }