R3ap3r/Aurora-Core
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix pgbouncer scram-sha-256 auth and document Postgres prod env vars
CI / lint (push) Canceled after 0s
Details
CI / typecheck (push) Canceled after 0s
Details
CI / unit-tests (push) Canceled after 0s
Details
CI / integration-tests (push) Canceled after 0s
Details
CI / container-build (push) Canceled after 0s
Details
CI / dependency-audit (push) Canceled after 0s
Details

Browse Source 
Two real bugs hit during tonight's first production deploy (found and
fixed live on the server, folded back into the tracked config so the
next deploy doesn't hit either wall):

1. pgbouncer defaults to md5 auth; postgres:17-alpine defaults password_encryption
   to scram-sha-256. Every connection failed with "wrong password type"
   until AUTH_TYPE=scram-sha-256 was set explicitly on the pgbouncer service.

2. POSTGRES_USER/PASSWORD/DB were never documented anywhere (not in
   .env.example, despite docker-compose.prod.yml requiring them) --
   added, with a note against `openssl rand -base64` for the password
   specifically: its output can contain /+=, which breaks pgbouncer's
   (and any DATABASE_URL parser's) naive URL parsing. Pointed at
   token_urlsafe instead, matching the other generated secrets.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
This commit is contained in:
NixReaper
2026-09-05 21:52:11 -05:00
co-authored by Claude Sonnet 5
parent 905cd202eb
commit 39b2d4bfcd
3 changed files with 18 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+3 -2
View File
@@ -184,8 +184,9 @@ once the subdomain exists and DNS resolves).
either cPanel/WHM's Application Manager if available, or a custom
Apache/LiteSpeed vhost include (`ProxyPass`/`ProxyPassReverse` for
Apache; LiteSpeed's External App + rewrite rule for LiteSpeed).
3. **`.env`** on the server (never committed), beyond the base vars in
`.env.example`:
3. **`.env`** on the server (never committed) — fill in every value in
`.env.example`, including the "Production only" section at the bottom
(`POSTGRES_USER`/`PASSWORD`/`DB`), plus:
```bash
CORS_ORIGINS=https://www.amdbs.net # must include the frontend's real origin