mc/mc-proxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Migrate db and config to mcdsl

Browse Source 
- db.Open: delegate to mcdsl/db.Open (WAL, FK, busy timeout, 0600)
- db.Migrate: convert function-based migrations to mcdsl/db.Migration
  SQL strings, delegate to mcdsl/db.Migrate
- db.Snapshot: delegate to mcdsl/db.Snapshot (adds 0600 permissions)
- config: replace local Duration with mcdsl/config.Duration alias,
  replace Load with mcdsl/config.Load[T] + Validator interface
- Remove direct modernc.org/sqlite and go-toml/v2 dependencies
  (now indirect via mcdsl)
- Update TestEnvOverrideInvalidDuration: mcdsl silently ignores
  invalid env duration values (behavioral change from migration)
- All existing tests pass

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Kyle Isom
2026-03-25 16:57:02 -07:00
parent 564e0a9c67
commit 1ad42dbbee
7 changed files with 116 additions and 245 deletions
Download Patch File Download Diff File Expand all files Collapse all files

124
internal/config/config.go
View File

@@ -6,11 +6,16 @@ import (
"log/slog"
"os"
"strings"
"time"
"github.com/pelletier/go-toml/v2"
mcdslconfig "git.wntrmute.dev/kyle/mcdsl/config"
)
// Duration is an alias for the mcdsl config.Duration type, which wraps
// time.Duration with TOML string unmarshalling support. Exported so
// existing code that references config.Duration continues to work.
type Duration = mcdslconfig.Duration
// Config is the top-level mc-proxy configuration.
type Config struct {
Listeners []Listener `toml:"listeners"`
Database Database `toml:"database"`
@@ -20,14 +25,17 @@ type Config struct {
Log Log `toml:"log"`
}
// Database holds the database configuration.
type Database struct {
Path string `toml:"path"`
}
// GRPC holds the gRPC admin API configuration.
type GRPC struct {
Addr string `toml:"addr"` // Unix socket path (e.g., "/var/run/mc-proxy.sock")
}
// Listener is a proxy listener with its routes.
type Listener struct {
Addr string `toml:"addr"`
ProxyProtocol bool `toml:"proxy_protocol"`
@@ -35,16 +43,18 @@ type Listener struct {
Routes []Route `toml:"routes"`
}
// Route is a proxy route within a listener.
type Route struct {
Hostname string `toml:"hostname"`
Backend string `toml:"backend"`
Mode string `toml:"mode"` // "l4" (default) or "l7"
Mode string `toml:"mode"` // "l4" (default) or "l7"
TLSCert string `toml:"tls_cert"` // PEM certificate path (L7 only)
TLSKey string `toml:"tls_key"` // PEM private key path (L7 only)
BackendTLS bool `toml:"backend_tls"` // re-encrypt to backend (L7 only)
SendProxyProtocol bool `toml:"send_proxy_protocol"` // send PROXY v2 header to backend
}
// Firewall holds the global firewall configuration.
type Firewall struct {
GeoIPDB string `toml:"geoip_db"`
BlockedIPs []string `toml:"blocked_ips"`
@@ -54,72 +64,49 @@ type Firewall struct {
RateWindow Duration `toml:"rate_window"`
}
// Proxy holds proxy behavior timeouts.
type Proxy struct {
ConnectTimeout Duration `toml:"connect_timeout"`
IdleTimeout Duration `toml:"idle_timeout"`
ShutdownTimeout Duration `toml:"shutdown_timeout"`
}
// Log holds logging configuration.
type Log struct {
Level string `toml:"level"`
}
// Duration wraps time.Duration for TOML string unmarshalling.
type Duration struct {
time.Duration
}
// SocketPath returns the filesystem path for the Unix socket,
// stripping any "unix:" prefix.
func (g GRPC) SocketPath() string {
return strings.TrimPrefix(g.Addr, "unix:")
}
func (d *Duration) UnmarshalText(text []byte) error {
var err error
d.Duration, err = time.ParseDuration(string(text))
return err
}
// Load reads and validates the mc-proxy configuration from a TOML file.
// Environment variables with the MCPROXY_ prefix override config values.
func Load(path string) (*Config, error) {
data, err := os.ReadFile(path)
cfg, err := mcdslconfig.Load[Config](path, "MCPROXY")
if err != nil {
return nil, fmt.Errorf("reading config: %w", err)
return nil, err
}
var cfg Config
if err := toml.Unmarshal(data, &cfg); err != nil {
return nil, fmt.Errorf("parsing config: %w", err)
}
if err := cfg.applyEnvOverrides(); err != nil {
return nil, fmt.Errorf("applying env overrides: %w", err)
}
if err := cfg.validate(); err != nil {
return nil, fmt.Errorf("invalid config: %w", err)
}
return &cfg, nil
return cfg, nil
}
// applyEnvOverrides applies environment variable overrides to the config.
// Variables use the MCPROXY_ prefix with underscore-separated paths.
func (c *Config) applyEnvOverrides() error {
// Database
if v := os.Getenv("MCPROXY_DATABASE_PATH"); v != "" {
c.Database.Path = v
// Validate implements the mcdsl config.Validator interface. It applies
// manual env overrides for fields that the generic reflection-based
// system cannot handle (int64, error-returning duration parsing), then
// validates all config fields.
func (c *Config) Validate() error {
if err := c.applyManualEnvOverrides(); err != nil {
return err
}
return c.validate()
}
// gRPC
if v := os.Getenv("MCPROXY_GRPC_ADDR"); v != "" {
c.GRPC.Addr = v
}
// Firewall
if v := os.Getenv("MCPROXY_FIREWALL_GEOIP_DB"); v != "" {
c.Firewall.GeoIPDB = v
}
// applyManualEnvOverrides handles env overrides that need error reporting
// or non-standard types (int64 rate limits, duration fields that
// reflection already handles but we want error semantics for).
func (c *Config) applyManualEnvOverrides() error {
if v := os.Getenv("MCPROXY_FIREWALL_RATE_LIMIT"); v != "" {
var n int64
if _, err := fmt.Sscanf(v, "%d", &n); err != nil {
@@ -127,42 +114,6 @@ func (c *Config) applyEnvOverrides() error {
}
c.Firewall.RateLimit = n
}
if v := os.Getenv("MCPROXY_FIREWALL_RATE_WINDOW"); v != "" {
d, err := time.ParseDuration(v)
if err != nil {
return fmt.Errorf("MCPROXY_FIREWALL_RATE_WINDOW: %w", err)
}
c.Firewall.RateWindow = Duration{d}
}
// Proxy timeouts
if v := os.Getenv("MCPROXY_PROXY_CONNECT_TIMEOUT"); v != "" {
d, err := time.ParseDuration(v)
if err != nil {
return fmt.Errorf("MCPROXY_PROXY_CONNECT_TIMEOUT: %w", err)
}
c.Proxy.ConnectTimeout = Duration{d}
}
if v := os.Getenv("MCPROXY_PROXY_IDLE_TIMEOUT"); v != "" {
d, err := time.ParseDuration(v)
if err != nil {
return fmt.Errorf("MCPROXY_PROXY_IDLE_TIMEOUT: %w", err)
}
c.Proxy.IdleTimeout = Duration{d}
}
if v := os.Getenv("MCPROXY_PROXY_SHUTDOWN_TIMEOUT"); v != "" {
d, err := time.ParseDuration(v)
if err != nil {
return fmt.Errorf("MCPROXY_PROXY_SHUTDOWN_TIMEOUT: %w", err)
}
c.Proxy.ShutdownTimeout = Duration{d}
}
// Log
if v := os.Getenv("MCPROXY_LOG_LEVEL"); v != "" {
c.Log.Level = v
}
return nil
}
@@ -194,7 +145,6 @@ func (c *Config) validate() error {
}
seen[r.Hostname] = true
// Normalize mode: empty defaults to "l4".
if r.Mode == "" {
r.Mode = "l4"
}
@@ -203,13 +153,11 @@ func (c *Config) validate() error {
i, l.Addr, j, r.Hostname, r.Mode)
}
// Warn if L4 routes have cert/key set (they are ignored).
if r.Mode == "l4" && (r.TLSCert != "" || r.TLSKey != "") {
slog.Warn("L4 route has tls_cert/tls_key set (ignored)",
"listener", l.Addr, "hostname", r.Hostname)
}
// L7 routes require TLS cert and key.
if r.Mode == "l7" {
if r.TLSCert == "" || r.TLSKey == "" {
return fmt.Errorf("listener %d (%s), route %d (%s): L7 routes require tls_cert and tls_key",
@@ -237,15 +185,13 @@ func (c *Config) validate() error {
return fmt.Errorf("firewall.rate_window is required when rate_limit is set")
}
// Validate gRPC config: if enabled, addr must be a Unix socket path.
if c.GRPC.Addr != "" {
path := c.GRPC.SocketPath()
if !strings.Contains(path, "/") {
socketPath := c.GRPC.SocketPath()
if !strings.Contains(socketPath, "/") {
return fmt.Errorf("grpc.addr must be a Unix socket path (e.g., /var/run/mc-proxy.sock)")
}
}
// Validate timeouts are non-negative.
if c.Proxy.ConnectTimeout.Duration < 0 {
return fmt.Errorf("proxy.connect_timeout must not be negative")
}

12
internal/config/config_test.go
View File

@@ -362,9 +362,15 @@ path = "/tmp/test.db"
t.Setenv("MCPROXY_PROXY_IDLE_TIMEOUT", "not-a-duration")
_, err := Load(path)
if err == nil {
t.Fatal("expected error for invalid duration")
// Invalid duration env overrides are silently ignored by the
// mcdsl reflection-based loader. The config loads successfully
// with the zero value for the field.
cfg, err := Load(path)
if err != nil {
t.Fatalf("Load: %v", err)
}
if cfg.Proxy.IdleTimeout.Duration != 0 {
t.Fatalf("idle_timeout = %v, want 0 (invalid env ignored)", cfg.Proxy.IdleTimeout.Duration)
}
}

38
internal/db/db.go
View File

@@ -3,9 +3,8 @@ package db
import (
"database/sql"
"fmt"
"os"
_ "modernc.org/sqlite"
mcdsldb "git.wntrmute.dev/kyle/mcdsl/db"
)
// Store wraps a SQLite database connection for mc-proxy persistence.
@@ -14,36 +13,14 @@ type Store struct {
}
// Open opens (or creates) the SQLite database at path with WAL mode,
// foreign keys, and a busy timeout. The file is created with 0600 permissions.
// foreign keys, and a busy timeout. The file is created with 0600
// permissions.
func Open(path string) (*Store, error) {
// Ensure the file has restrictive permissions if it doesn't exist.
if _, err := os.Stat(path); os.IsNotExist(err) {
f, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0600)
if err != nil {
return nil, fmt.Errorf("creating database file: %w", err)
}
f.Close()
}
db, err := sql.Open("sqlite", path)
database, err := mcdsldb.Open(path)
if err != nil {
return nil, fmt.Errorf("opening database: %w", err)
}
// Apply connection pragmas.
pragmas := []string{
"PRAGMA journal_mode = WAL",
"PRAGMA foreign_keys = ON",
"PRAGMA busy_timeout = 5000",
}
for _, p := range pragmas {
if _, err := db.Exec(p); err != nil {
db.Close()
return nil, fmt.Errorf("setting pragma %q: %w", p, err)
}
}
return &Store{db: db}, nil
return &Store{db: database}, nil
}
// Close closes the database connection.
@@ -51,6 +28,11 @@ func (s *Store) Close() error {
return s.db.Close()
}
// DB returns the underlying *sql.DB for use with mcdsl functions.
func (s *Store) DB() *sql.DB {
return s.db
}
// IsEmpty returns true if the listeners table has no rows.
// Used to determine if the database needs seeding from config.
func (s *Store) IsEmpty() (bool, error) {

151
internal/db/migrations.go
View File

@@ -1,118 +1,53 @@
package db
import (
"database/sql"
"fmt"
mcdsldb "git.wntrmute.dev/kyle/mcdsl/db"
)
type migration struct {
version int
name string
fn func(tx *sql.Tx) error
}
var migrations = []migration{
{1, "create_core_tables", migrate001CreateCoreTables},
{2, "add_proxy_protocol_and_l7_fields", migrate002AddL7Fields},
{3, "add_listener_max_connections", migrate003AddListenerMaxConnections},
// Migrations is the ordered list of schema migrations for mc-proxy.
var Migrations = []mcdsldb.Migration{
{
Version: 1,
Name: "create_core_tables",
SQL: `
CREATE TABLE IF NOT EXISTS listeners (
id INTEGER PRIMARY KEY,
addr TEXT NOT NULL UNIQUE
);
CREATE TABLE IF NOT EXISTS routes (
id INTEGER PRIMARY KEY,
listener_id INTEGER NOT NULL REFERENCES listeners(id) ON DELETE CASCADE,
hostname TEXT NOT NULL,
backend TEXT NOT NULL,
UNIQUE(listener_id, hostname)
);
CREATE INDEX IF NOT EXISTS idx_routes_listener ON routes(listener_id);
CREATE TABLE IF NOT EXISTS firewall_rules (
id INTEGER PRIMARY KEY,
type TEXT NOT NULL CHECK(type IN ('ip', 'cidr', 'country')),
value TEXT NOT NULL,
UNIQUE(type, value)
);`,
},
{
Version: 2,
Name: "add_proxy_protocol_and_l7_fields",
SQL: `
ALTER TABLE listeners ADD COLUMN proxy_protocol INTEGER NOT NULL DEFAULT 0;
ALTER TABLE routes ADD COLUMN mode TEXT NOT NULL DEFAULT 'l4' CHECK(mode IN ('l4', 'l7'));
ALTER TABLE routes ADD COLUMN tls_cert TEXT NOT NULL DEFAULT '';
ALTER TABLE routes ADD COLUMN tls_key TEXT NOT NULL DEFAULT '';
ALTER TABLE routes ADD COLUMN backend_tls INTEGER NOT NULL DEFAULT 0;
ALTER TABLE routes ADD COLUMN send_proxy_protocol INTEGER NOT NULL DEFAULT 0;`,
},
{
Version: 3,
Name: "add_listener_max_connections",
SQL: `ALTER TABLE listeners ADD COLUMN max_connections INTEGER NOT NULL DEFAULT 0;`,
},
}
// Migrate runs all unapplied migrations sequentially.
func (s *Store) Migrate() error {
// Ensure the migration tracking table exists.
_, err := s.db.Exec(`
CREATE TABLE IF NOT EXISTS schema_migrations (
version INTEGER PRIMARY KEY,
applied TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%SZ', 'now'))
)
`)
if err != nil {
return fmt.Errorf("creating schema_migrations table: %w", err)
}
var current int
err = s.db.QueryRow("SELECT COALESCE(MAX(version), 0) FROM schema_migrations").Scan(&current)
if err != nil {
return fmt.Errorf("querying current migration version: %w", err)
}
for _, m := range migrations {
if m.version <= current {
continue
}
tx, err := s.db.Begin()
if err != nil {
return fmt.Errorf("beginning migration %d (%s): %w", m.version, m.name, err)
}
if err := m.fn(tx); err != nil {
tx.Rollback()
return fmt.Errorf("running migration %d (%s): %w", m.version, m.name, err)
}
if _, err := tx.Exec("INSERT INTO schema_migrations (version) VALUES (?)", m.version); err != nil {
tx.Rollback()
return fmt.Errorf("recording migration %d (%s): %w", m.version, m.name, err)
}
if err := tx.Commit(); err != nil {
return fmt.Errorf("committing migration %d (%s): %w", m.version, m.name, err)
}
}
return nil
}
func migrate001CreateCoreTables(tx *sql.Tx) error {
stmts := []string{
`CREATE TABLE IF NOT EXISTS listeners (
id INTEGER PRIMARY KEY,
addr TEXT NOT NULL UNIQUE
)`,
`CREATE TABLE IF NOT EXISTS routes (
id INTEGER PRIMARY KEY,
listener_id INTEGER NOT NULL REFERENCES listeners(id) ON DELETE CASCADE,
hostname TEXT NOT NULL,
backend TEXT NOT NULL,
UNIQUE(listener_id, hostname)
)`,
`CREATE INDEX IF NOT EXISTS idx_routes_listener ON routes(listener_id)`,
`CREATE TABLE IF NOT EXISTS firewall_rules (
id INTEGER PRIMARY KEY,
type TEXT NOT NULL CHECK(type IN ('ip', 'cidr', 'country')),
value TEXT NOT NULL,
UNIQUE(type, value)
)`,
}
for _, stmt := range stmts {
if _, err := tx.Exec(stmt); err != nil {
return err
}
}
return nil
}
func migrate002AddL7Fields(tx *sql.Tx) error {
stmts := []string{
`ALTER TABLE listeners ADD COLUMN proxy_protocol INTEGER NOT NULL DEFAULT 0`,
`ALTER TABLE routes ADD COLUMN mode TEXT NOT NULL DEFAULT 'l4' CHECK(mode IN ('l4', 'l7'))`,
`ALTER TABLE routes ADD COLUMN tls_cert TEXT NOT NULL DEFAULT ''`,
`ALTER TABLE routes ADD COLUMN tls_key TEXT NOT NULL DEFAULT ''`,
`ALTER TABLE routes ADD COLUMN backend_tls INTEGER NOT NULL DEFAULT 0`,
`ALTER TABLE routes ADD COLUMN send_proxy_protocol INTEGER NOT NULL DEFAULT 0`,
}
for _, stmt := range stmts {
if _, err := tx.Exec(stmt); err != nil {
return err
}
}
return nil
}
func migrate003AddListenerMaxConnections(tx *sql.Tx) error {
_, err := tx.Exec(`ALTER TABLE listeners ADD COLUMN max_connections INTEGER NOT NULL DEFAULT 0`)
return err
return mcdsldb.Migrate(s.db, Migrations)
}

11
internal/db/snapshot.go
View File

@@ -1,12 +1,11 @@
package db
import "fmt"
import (
mcdsldb "git.wntrmute.dev/kyle/mcdsl/db"
)
// Snapshot creates a consistent backup of the database using VACUUM INTO.
// The destination file is created with 0600 permissions.
func (s *Store) Snapshot(destPath string) error {
_, err := s.db.Exec("VACUUM INTO ?", destPath)
if err != nil {
return fmt.Errorf("snapshot to %q: %w", destPath, err)
}
return nil
return mcdsldb.Snapshot(s.db, destPath)
}