From: Konstantin Knizhnik <k.knizhnik@postgrespro.ru>
To: Julien Riou <julien@riou.xyz>
To: pgsql-hackers@lists.postgresql.org
Subject: Re: PROXY protocol support
Date: Mon, 20 May 2019 18:28:43 +0300
Message-ID: <4d3d6536-77ca-3bbf-4b1e-0bcff5afb266@postgrespro.ru> (raw)
In-Reply-To: <20190519153623.GB13208@thinkpad>
References: <20190519153623.GB13208@thinkpad>
On 19.05.2019 18:36, Julien Riou wrote:
> Hello,
>
> Nowadays, PostgreSQL is often used behind proxies. Some are PostgreSQL
> protocol aware (Pgpool, PgBouncer), some are pure TCP (HAProxy). From
> the database instance point of view, all clients come from the proxy.
>
> There are two major problems with this topology:
>
> * It neutralizes the host based authentication. Every client shares
> the same source. Either we allow this source or not but we cannot allow
> clients on a more fine-grained basis, or not by the IP address.
>
> * It makes debugging harder. If we have a DDL or a slow query logged, we
> cannot use the source to identify who is responsible.
>
> On one hand, we can move the authentication and logging mechanisms to
> PostgreSQL based proxies but they will never be as complete as
> PostgreSQL itself. And they don't have features like HTTP health checks
> to redirect trafic to nodes (health, role, whatever behind the URL). On
> the other hand, those features are not implemented at all because they
> don't know the PostgreSQL protocol, they simply forward requests.
>
> In the HTTP reverse proxies world, there's a "dirty hack" to identify
> the source IP address: add an HTTP header "X-Forwared-For" to the
> request. It's the destination duty to do whatever they want with this
> information. With this feature in mind, someone from HAProxy has
> implemented this mechanism at the protocol level. It's called the PROXY
> protocol.
>
> With this piece of logic at the beginning of the protocol, we could
> implement a totally transparent proxy and benefit from the great
> features of PostgreSQL regarding clients. Note that MariaDB support the
> PROXY protocol in MaxScale (proxy) and MariaDB Server in recent
> versions.
>
> My question is, what do you think of this feature? Is it worth to spend
> time implementing it in PostgreSQL or not?
>
> Links:
> - http://www.haproxy.org/download/1.8/doc/proxy-protocol.txt
> - https://mariadb.com/kb/en/library/proxy-protocol-support/
>
> Thanks,
> Julien
>
> PS: I've already sent this message to a wrong mailing list. Stephen
> Frost said it's implemented in pgbouncer but all I can find is an open
> issue: https://github.com/pgbouncer/pgbouncer/issues/241.
>
>
Hi,
From my point of view it will be better to support embedded connection
pooler in Postgres.
In this case all mentioned problems can be more or less
straightforwardly solved without inventing new protocol.
There is my prototype implementation of built-in connection pooler on
commit-fest:
https://commitfest.postgresql.org/23/2067/
--
Konstantin Knizhnik
Postgres Professional: http://www.postgrespro.com
The Russian Postgres Company
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: k.knizhnik@postgrespro.ru, julien@riou.xyz, pgsql-hackers@lists.postgresql.org
Subject: Re: PROXY protocol support
In-Reply-To: <4d3d6536-77ca-3bbf-4b1e-0bcff5afb266@postgrespro.ru>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox