public inbox for [email protected]  

help / color / mirror / Atom feed

From: Julien Riou <[email protected]>
To: [email protected]
Subject: PROXY protocol support
Date: Sun, 19 May 2019 16:26:04 +0200
Message-ID: <20190519142604.GA5843@thinkpad> (raw)

Hello,

Nowadays, PostgreSQL is often used behind proxies. Some are PostgreSQL
protocol aware (Pgpool, PgBouncer), some are pure TCP (HAProxy). From
the database instance point of view, all clients come from the proxy.

There are two major problems with this topology:

* It neutralizes the host based authentication. Every client shares
the same source. Either we allow this source or not but we cannot allow
clients on a more fine-grained basis, or not by the IP address.

* It makes debugging harder. If we have a DDL or a slow query logged, we
cannot use the source to identify who is responsible.

On one hand, we can move the authentication and logging mechanisms to
PostgreSQL based proxies but they will never be as complete as
PostgreSQL itself. And they don't have features like HTTP health checks
to redirect trafic to nodes (health, role, whatever behind the URL). On
the other hand, those features are not implemented at all because they
don't know the PostgreSQL protocol, they simply forward requests.

In the HTTP reverse proxies world, there's a "dirty hack" to identify
the source IP address: add an HTTP header "X-Forwared-For" to the
request. It's the destination duty to do whatever they want with this
information. With this feature in mind, someone from HAProxy has
implemented this mechanism at the protocol level. It's called the PROXY
protocol.

With this piece of logic at the beginning of the protocol, we could
implement a totally transparent proxy and benefit from the great
features of PostgreSQL regarding clients. Note that MariaDB support the
PROXY protocol in MaxScale (proxy) and MariaDB Server in recent
versions.

My question is, what do you think of this feature? Is it worth to spend
time implementing it in PostgreSQL or not?

Links:
 - http://www.haproxy.org/download/1.8/doc/proxy-protocol.txt
 - https://mariadb.com/kb/en/library/proxy-protocol-support/

Thanks,
Julien

view thread (3+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected]
  Subject: Re: PROXY protocol support
  In-Reply-To: <20190519142604.GA5843@thinkpad>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox