canvas-lms/config/database.yml.example

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

31 lines
620 B
Plaintext
Raw Normal View History

# do not create a queue: section for your test environment
2011-02-01 09:57:29 +08:00
test:
adapter: postgresql
2011-02-01 09:57:29 +08:00
encoding: utf8
database: canvas_test
host: localhost
username: canvas
password: your_password
2011-02-01 09:57:29 +08:00
timeout: 5000
shard1: canvas_test_shard_1
shard2: canvas_test_shard_2
2011-02-01 09:57:29 +08:00
development:
adapter: postgresql
2011-02-01 09:57:29 +08:00
encoding: utf8
database: canvas_development
password: your_password
2011-02-01 09:57:29 +08:00
timeout: 5000
create read-only "secondary" db user for dev/test and activate this user while on the "secondary" in tests Canvas uses read-only secondary database replicas, but before now, GuardRail.activate(:secondary) had no effect in specs. The result is that specs wouldn't catch attempts to write to a secondary, and the error would be discovered in production, often requiring a hotfix. This patchset sets up a migration that creates a `canvas_readonly_user` in the database and sets up SELECT permissions for it in each shard's schema. (The migration does nothing in production.) It also stubs out GuardRail in specs to run `SET ROLE canvas_readonly_user` when activating the secondary, and `RESET ROLE` when returning to the primary. test plan: - specs pass (this PS includes specs that attempt to write to the secondary and verify the correct error is raised) - use the read-only user in development by adding the following to the development section in config/database.yml: secondary: username: canvas_readonly_user then try to write to the secondary in the rails console and ensure you get a permission denied error. for example, GuardRail.activate(:secondary) { User.create! } should result in PG::InsufficientPrivilege: ERROR: permission denied for table users (ActiveRecord::StatementInvalid) flag = none closes LS-2818 Change-Id: Ibfa75af821eb7f5d65f6b26aea03417378ab255a Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/161086 QA-Review: Isaac Moore <isaac.moore@instructure.com> Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com> Reviewed-by: Cody Cutrer <cody@instructure.com> Product-Review: Cody Cutrer <cody@instructure.com>
2021-11-02 08:24:48 +08:00
secondary:
replica: true
create read-only "secondary" db user for dev/test and activate this user while on the "secondary" in tests Canvas uses read-only secondary database replicas, but before now, GuardRail.activate(:secondary) had no effect in specs. The result is that specs wouldn't catch attempts to write to a secondary, and the error would be discovered in production, often requiring a hotfix. This patchset sets up a migration that creates a `canvas_readonly_user` in the database and sets up SELECT permissions for it in each shard's schema. (The migration does nothing in production.) It also stubs out GuardRail in specs to run `SET ROLE canvas_readonly_user` when activating the secondary, and `RESET ROLE` when returning to the primary. test plan: - specs pass (this PS includes specs that attempt to write to the secondary and verify the correct error is raised) - use the read-only user in development by adding the following to the development section in config/database.yml: secondary: username: canvas_readonly_user then try to write to the secondary in the rails console and ensure you get a permission denied error. for example, GuardRail.activate(:secondary) { User.create! } should result in PG::InsufficientPrivilege: ERROR: permission denied for table users (ActiveRecord::StatementInvalid) flag = none closes LS-2818 Change-Id: Ibfa75af821eb7f5d65f6b26aea03417378ab255a Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/161086 QA-Review: Isaac Moore <isaac.moore@instructure.com> Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com> Reviewed-by: Cody Cutrer <cody@instructure.com> Product-Review: Cody Cutrer <cody@instructure.com>
2021-11-02 08:24:48 +08:00
username: canvas_readonly_user
2011-02-01 09:57:29 +08:00
production:
adapter: postgresql
2011-02-01 09:57:29 +08:00
encoding: utf8
database: canvas_production
host: localhost
username: canvas
password: your_password
timeout: 5000