From 6bf28f3a780f7739a4b33b19f87fbe398eb744b2 Mon Sep 17 00:00:00 2001 From: Kevin Jahns Date: Mon, 31 Aug 2026 23:41:19 +0200 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=A7(yhub)=20align=20the=20yhub=20db=20?= =?UTF-8?q?credentials=20with=20the=20backend's=20dev=20ones?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The yhub database ran under its own yhub role. Every other database in this stack uses the backend's dev credentials, dinum/pass, which is also what CI already uses for this database; only the database name stays apart, since it is a separate database on a separate server. The url the collaboration server connects with moves into the same file, beside the credentials it repeats, written once rather than twice — the yhub service reads the file as well. A yhub-postgres.local override is created like for the other env files, and the healthcheck asks about POSTGRES_DB and POSTGRES_USER like the other two do instead of naming the role. POSTGRES_USER only takes effect on a fresh initdb, so an existing stack needs its yhub-pgdata volume dropped and `make migrate-yhub` re-run; the volume holds local document state only. Signed-off-by: Kevin Jahns --- Makefile | 1 + compose.yml | 11 ++++++++--- env.d/development/yhub | 12 +++++++----- env.d/development/yhub-postgres | 11 ++++++++++- src/yhub-server/README.md | 8 +++++--- 5 files changed, 31 insertions(+), 12 deletions(-) diff --git a/Makefile b/Makefile index 603fe4d91..76340bbfd 100644 --- a/Makefile +++ b/Makefile @@ -88,6 +88,7 @@ create-env-local-files: @touch env.d/development/postgresql.local @touch env.d/development/kc_auth.local @touch env.d/development/kc_postgresql.local + @touch env.d/development/yhub-postgres.local @touch env.d/development/yhub.local .PHONY: create-env-local-files diff --git a/compose.yml b/compose.yml index b59a62b09..42ec200c7 100644 --- a/compose.yml +++ b/compose.yml @@ -229,10 +229,11 @@ services: image: postgres:16-alpine env_file: - env.d/development/yhub-postgres + - env.d/development/yhub-postgres.local volumes: - yhub-pgdata:/var/lib/postgresql/data healthcheck: - test: ["CMD-SHELL", "pg_isready -U yhub"] + test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"] interval: 1s timeout: 2s retries: 60 @@ -251,9 +252,13 @@ services: image: impress:yhub-development environment: HOME: /tmp # same reason as node-based services above (unmapped uid) - # its own file rather than the backend's: this server reads none of the - # django settings `common` carries, and everything it does read is in there + # its own files rather than the backend's: this server reads none of the + # django settings `common` carries. The database url is in the file its + # postgres is configured from, beside the credentials it spells out; + # everything else this server reads is in `yhub` env_file: + - env.d/development/yhub-postgres + - env.d/development/yhub-postgres.local - env.d/development/yhub - env.d/development/yhub.local volumes: diff --git a/env.d/development/yhub b/env.d/development/yhub index 3c7b73a3a..95b4b81d9 100644 --- a/env.d/development/yhub +++ b/env.d/development/yhub @@ -1,14 +1,16 @@ # Collaboration server (yhub) # -# Everything the collaboration server reads, and nothing else: it shares the -# backend's stores and origins by value, not by loading the backend's own -# environment. Override any of it in yhub.local, which is not committed. +# Everything the collaboration server reads but its database url, and nothing +# else: it shares the backend's stores and origins by value, not by loading the +# backend's own environment. Override any of it in yhub.local, which is not +# committed. # Stores. Its own valkey and its own postgres database — the backend's live -# next to them and are never touched from here. +# next to them and are never touched from here. The postgres url is not here +# but in `yhub-postgres`, the file that database is configured from, so that +# its credentials are written once; this service reads that file too. PORT=3002 REDIS=redis://yhub-valkey:6379 -POSTGRES=postgres://yhub:pass@yhub-postgres:5432/yhub REDIS_PREFIX=yhub # Backend. It answers who a user is and what they may do with a document, and diff --git a/env.d/development/yhub-postgres b/env.d/development/yhub-postgres index a7aaf4d30..2e04e2122 100644 --- a/env.d/development/yhub-postgres +++ b/env.d/development/yhub-postgres @@ -1,4 +1,13 @@ # Postgresql db container configuration for the collaboration server (yhub). +# Its own database on its own server: the backend's lives next to it and is +# never touched from here. The credentials are the backend's dev ones, and the +# ones CI uses for this database too — only the database name differs. POSTGRES_DB=yhub -POSTGRES_USER=yhub +POSTGRES_USER=dinum POSTGRES_PASSWORD=pass + +# What the collaboration server connects with: the credentials above spelled as +# a url, which is the only form it takes. Read by the `yhub` service as well, +# which is why it lives here rather than next to the rest of that server's +# settings — the password is written once. +POSTGRES=postgres://dinum:pass@yhub-postgres:5432/yhub diff --git a/src/yhub-server/README.md b/src/yhub-server/README.md index cc7fd10e8..710f8c0fd 100644 --- a/src/yhub-server/README.md +++ b/src/yhub-server/README.md @@ -596,9 +596,11 @@ provider answers to), `LEGACY_S3_SIGNATURE_VERSION` (see below), and `LEGACY_S3_BUCKET_NAME` (defaults to Django's dev default `impress-media-storage`; production uses a different bucket name and must set it explicitly). The server refuses to boot when the flag is set without -endpoint and credentials. In development they come, like everything else this -server reads, from `env.d/development/yhub` (and `yhub.local`, which is not -committed — `make create-env-local-files` creates it). +endpoint and credentials. In development they come from +`env.d/development/yhub`, which holds everything this server reads but the +database url — that one is in `env.d/development/yhub-postgres`, beside the +credentials it spells out. Both have a `.local` counterpart, not committed, +that `make create-env-local-files` creates. The bucket is read with the **AWS SDK for JavaScript v3** (`@aws-sdk/client-s3`), the same library family boto3 is to Django, so the