Add pg_durable.host connection setting - #360
Merged
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
Adds a new postmaster, superuser-only pg_durable.host GUC to centrally control the host/socket directory used by all pg_durable-created PostgreSQL connections, with a shared resolver that falls back to PGHOST and then 127.0.0.1. This improves deployability by making connection targeting deterministic and testable across worker/provider pools and per-user connection paths.
Changes:
- Introduces
pg_durable.hostGUC registration (Postmaster,SUPERUSER_ONLY) and switches connection string/option construction to use the shared resolver. - Adds unit + catalog tests for host resolution precedence and GUC presence/context, plus a new E2E phase validating behavior when postmaster inherits an invalid
PGHOST. - Documents the new setting in the user guide and security review workbook.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| USER_GUIDE.md | Documents the new pg_durable.host setting and its precedence relative to PGHOST. |
| docs/security-review/workbook-data.md | Adds pg_durable.host to the security workbook configuration table and clarifies PGHOST purpose. |
| src/lib.rs | Registers pg_durable.host as a postmaster, superuser-only GUC; adds catalog tests for boot value and context. |
| src/types.rs | Centralizes host resolution (pg_durable.host → PGHOST → 127.0.0.1) and routes connection builders through it. |
| scripts/test-e2e-local.sh | Adds a host-guc E2E phase and starts the server with an overridden PGHOST for that phase. |
| tests/e2e/sql/67_host_guc.sql | New E2E test validating that both workflow SQL and transaction_mode => 'new' use the GUC-selected socket host. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| |---|---|---|---| | ||
| | `pg_durable.worker_role` | "postgres" | Postmaster | Determines background worker's PostgreSQL identity; must be superuser | | ||
| | `pg_durable.database` | "postgres" | Postmaster | Target database for extension operations | | ||
| | `pg_durable.host` | unset | Postmaster | Overrides `PGHOST` for all connections created by pg_durable | |
Drop GucFlags::SUPERUSER_ONLY so pg_durable.host matches the visibility of pg_durable.worker_role and pg_durable.database; the Postmaster context already prevents runtime changes. Percent-encode connection URL hosts that are not plain names, IPv4 addresses, or bracketed IPv6 literals. A misconfigured host carrying URL metacharacters now stays inside the host component and fails to resolve instead of injecting a different host or extra connection parameters. Set unix_socket_directories in every E2E phase instead of removing it, so the shared pgrx cluster keeps a socket directory for `make installcheck`. Also add the changelog entry, promote the user guide section out of "Connection Limits", and fix the missing trailing newline.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add a postmaster
pg_durable.hostGUC, modeled on pg_cron'scron.host, for selecting the PostgreSQL host used by connections created by pg_durable.Host resolution now follows this precedence:
pg_durable.hostPGHOST127.0.0.1An empty or unset
pg_durable.hostpreserves the existingPGHOSTbehavior. The shared resolver covers worker management and provider pools, backend client connections, workflow SQL connections, andtransaction_mode => 'new'launch connections.The GUC uses
GucFlags::default(), matchingpg_durable.worker_roleandpg_durable.database. ThePostmastercontext already prevents runtime changes, and the host is connection-topology metadata rather than a secret, so its value stays readable throughpg_settings.While centralizing host resolution,
build_connection_url()was hardened: any host that is not a plain name, IPv4 address, or bracketed IPv6 literal is percent-encoded. Unix-socket paths still round-trip (sqlx decodes them), while a misconfigured host carrying URL metacharacters stays inside the host component and fails to resolve instead of injecting a different host or extra connection parameters.The patch also documents the setting and adds:
pg_durable.hostto the pgrx Unix socket while the postmaster inherits an invalidPGHOSTtransaction_mode => 'new'No extension SQL or upgrade migration is required because the GUC is registered by the binary during preload.
Validation
cargo fmt -p pg_durable -- --checkcargo build --features pg17cargo clippy --no-default-features --features pg17,http-allow-test-domains -- -D warnings./scripts/test-unit.sh(297 passed, 16 ignored)./scripts/test-e2e-local.sh(55 passed)./scripts/test-upgrade.sh(86 passed)