PgBouncer logs pooler errors, not every client login and close (#148)

OP OpenVibers committed 21 days ago · 884a7d56b5 · 3 files, +7 −1

* PgBouncer logs pooler errors, not every client login and close (~31,000 journal lines in three hours)

* README: ovhost drops to the checkout owner through setpriv

Changes

ddiff --git a/README.md b/README.md
iindex 43726de..93d7478 100644
---- a/README.md
++++ b/README.md
@@@ -321,7 +321,7 @@ This was done on 2026-09-23 (the CLI and inventory are installed); the steps sta
     The tree must stay world-readable (default 0755/0644).
  2. **Inventory:** `sudo install -o root -g root -m 0640 host.example.json /etc/openvibe/host.json`, then correct it against the machine. Check the Community database path, the Tools unit list, and Events, which was not deployed as of 22 Sep.
  3. **State:** `/var/lib/openvibe-host` (root, 0750) holds the release logs, locks, snapshots, drill logs and backup run summaries. `/var/lib/openvibe-drills` (root, 0711) holds one directory per running drill, owned by the service user and removed afterwards. `/var/backups/openvibe` and everything in it is root-only (directories 0700, files 0600). The postgres OS user writes logical dumps into its own directory under `/var/backups/openvibe.staging` (root, 0711), and root takes each copy over from there. All of these are created on first use.
--4. **Run as root:** `sudo ovhost …`. `ovhost` drops to `ubuntu` for git/npm (`runuser`) and needs root for `systemctl`, `nginx -t`, reading `/etc/openvibe/*.env` (names only) and writing vhosts. For least privilege, give operator accounts a sudoers rule for `/usr/local/bin/ovhost` alone instead of a general `ALL`. Do **not** grant it to the `ubuntu` service user if that account has no sudo today.
++4. **Run as root:** `sudo ovhost …`. `ovhost` drops to `ubuntu` for git/npm (`setpriv`, no PAM session) and needs root for `systemctl`, `nginx -t`, reading `/etc/openvibe/*.env` (names only) and writing vhosts. For least privilege, give operator accounts a sudoers rule for `/usr/local/bin/ovhost` alone instead of a general `ALL`. Do **not** grant it to the `ubuntu` service user if that account has no sudo today.
  5. **First run:** `sudo ovhost status`, then `sudo ovhost validate <each service>`, then `sudo ovhost plan live`, all read-only apart from `git fetch`. Adopt `deploy` one service at a time, starting with one that has no protected sessions.
  6. **Scheduled backups:** see [docs/backups.md](docs/backups.md#installing-on-the-host-operator) (bucket, key, `/etc/openvibe/backup.env`, `openvibe-backup.timer`).
  7. **Updating the CLI itself:** a deploy of this repository replaces `/opt/openvibe.host` (the catalog service), not the root-owned install at `/usr/local/lib/openvibe-host`, so after a merge to `main` run `sudo ovhost self-update`. It finds its own install directory from its real path (`/usr/local/bin/ovhost` → `/usr/local/lib/openvibe-host/bin/ovhost`), fetches `origin main`, refuses a dirty tree, a branch other than `main` or a divergence, merges `--ff-only` and runs `npm ci --omit=dev --no-audit --no-fund` there; `--dry-run` prints the plan first. It restarts nothing — the next `ovhost` invocation runs the new code. Without it the installed CLI silently runs behind `main` (on 2026-10-02 it was 16 commits behind: no `env-names --set`, no `logs`, no Bot vhost).
ddiff --git a/roles/data/files/pgbouncer.ini b/roles/data/files/pgbouncer.ini
iindex 69e5d39..17d578d 100644
---- a/roles/data/files/pgbouncer.ini
++++ b/roles/data/files/pgbouncer.ini
@@@ -28,5 +28,9 @@ query_wait_timeout = 30
  ignore_startup_parameters = extra_float_digits,options,application_name
  stats_users = ov_monitor
  admin_users = pgbouncer_auth
++; Pooler errors are logged; each client's login and close are not: services' pools reconnect all the time, and those
++; two lines were ~31,000 a three-hour window in the journal (2026-10-23), next to nothing worth reading.
++log_connections = 0
++log_disconnections = 0
  logfile = /var/log/postgresql/pgbouncer.log
  pidfile = /var/run/postgresql/pgbouncer.pid
ddiff --git a/test/data-role.test.js b/test/data-role.test.js
iindex bd91930..fbe8d56 100644
---- a/test/data-role.test.js
++++ b/test/data-role.test.js
@@@ -32,6 +32,8 @@ runTests([
          assert.match(pb, /^listen_addr = 127\.0\.0\.1/m);
          assert.match(pb, /^pool_mode = transaction/m);
          assert.match(pb, /^auth_type = scram-sha-256/m);
++        assert.match(pb, /^log_connections = 0$/m, 'client logins are not logged (journal noise)');
++        assert.match(pb, /^log_disconnections = 0$/m);
          const vk = read('files/valkey-openvibe.conf');
          assert.match(vk, /^bind 127\.0\.0\.1 -::1/m);
          assert.match(vk, /^maxmemory-policy volatile-lru/m);

diff --git a/README.md b/README.md

index 43726de..93d7478 100644

--- a/README.md

+++ b/README.md

@@ -321,7 +321,7 @@ This was done on 2026-09-23 (the CLI and inventory are installed); the steps sta

The tree must stay world-readable (default 0755/0644).

2. **Inventory:** `sudo install -o root -g root -m 0640 host.example.json /etc/openvibe/host.json`, then correct it against the machine. Check the Community database path, the Tools unit list, and Events, which was not deployed as of 22 Sep.

3. **State:** `/var/lib/openvibe-host` (root, 0750) holds the release logs, locks, snapshots, drill logs and backup run summaries. `/var/lib/openvibe-drills` (root, 0711) holds one directory per running drill, owned by the service user and removed afterwards. `/var/backups/openvibe` and everything in it is root-only (directories 0700, files 0600). The postgres OS user writes logical dumps into its own directory under `/var/backups/openvibe.staging` (root, 0711), and root takes each copy over from there. All of these are created on first use.

-4. **Run as root:** `sudo ovhost …`. `ovhost` drops to `ubuntu` for git/npm (`runuser`) and needs root for `systemctl`, `nginx -t`, reading `/etc/openvibe/*.env` (names only) and writing vhosts. For least privilege, give operator accounts a sudoers rule for `/usr/local/bin/ovhost` alone instead of a general `ALL`. Do **not** grant it to the `ubuntu` service user if that account has no sudo today.

+4. **Run as root:** `sudo ovhost …`. `ovhost` drops to `ubuntu` for git/npm (`setpriv`, no PAM session) and needs root for `systemctl`, `nginx -t`, reading `/etc/openvibe/*.env` (names only) and writing vhosts. For least privilege, give operator accounts a sudoers rule for `/usr/local/bin/ovhost` alone instead of a general `ALL`. Do **not** grant it to the `ubuntu` service user if that account has no sudo today.

5. **First run:** `sudo ovhost status`, then `sudo ovhost validate <each service>`, then `sudo ovhost plan live`, all read-only apart from `git fetch`. Adopt `deploy` one service at a time, starting with one that has no protected sessions.

6. **Scheduled backups:** see [docs/backups.md](docs/backups.md#installing-on-the-host-operator) (bucket, key, `/etc/openvibe/backup.env`, `openvibe-backup.timer`).

7. **Updating the CLI itself:** a deploy of this repository replaces `/opt/openvibe.host` (the catalog service), not the root-owned install at `/usr/local/lib/openvibe-host`, so after a merge to `main` run `sudo ovhost self-update`. It finds its own install directory from its real path (`/usr/local/bin/ovhost` → `/usr/local/lib/openvibe-host/bin/ovhost`), fetches `origin main`, refuses a dirty tree, a branch other than `main` or a divergence, merges `--ff-only` and runs `npm ci --omit=dev --no-audit --no-fund` there; `--dry-run` prints the plan first. It restarts nothing — the next `ovhost` invocation runs the new code. Without it the installed CLI silently runs behind `main` (on 2026-10-02 it was 16 commits behind: no `env-names --set`, no `logs`, no Bot vhost).

diff --git a/roles/data/files/pgbouncer.ini b/roles/data/files/pgbouncer.ini

index 69e5d39..17d578d 100644

--- a/roles/data/files/pgbouncer.ini

+++ b/roles/data/files/pgbouncer.ini

@@ -28,5 +28,9 @@ query_wait_timeout = 30

ignore_startup_parameters = extra_float_digits,options,application_name

stats_users = ov_monitor

admin_users = pgbouncer_auth

+; Pooler errors are logged; each client's login and close are not: services' pools reconnect all the time, and those

+; two lines were ~31,000 a three-hour window in the journal (2026-10-23), next to nothing worth reading.

+log_connections = 0

+log_disconnections = 0

logfile = /var/log/postgresql/pgbouncer.log

pidfile = /var/run/postgresql/pgbouncer.pid

diff --git a/test/data-role.test.js b/test/data-role.test.js

index bd91930..fbe8d56 100644

--- a/test/data-role.test.js

+++ b/test/data-role.test.js

@@ -32,6 +32,8 @@ runTests([

assert.match(pb, /^listen_addr = 127\.0\.0\.1/m);

assert.match(pb, /^pool_mode = transaction/m);

assert.match(pb, /^auth_type = scram-sha-256/m);

+ assert.match(pb, /^log_connections = 0$/m, 'client logins are not logged (journal noise)');

+ assert.match(pb, /^log_disconnections = 0$/m);

const vk = read('files/valkey-openvibe.conf');

assert.match(vk, /^bind 127\.0\.0\.1 -::1/m);

assert.match(vk, /^maxmemory-policy volatile-lru/m);