feat: add the "admin-server-host" config to set the host for the admi…

…n server

CHANGELOG.md

@@ -5,6 +5,10 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 ## Unreleased
 
+### Added
+
+ - #3558, Add the `admin-server-host` config to set the host for the admin server - @develop7
+
 ### Changed
 
  - #2052, Dropped support for PostgreSQL 9.6 - @wolfgangwalther

docs/references/configuration.rst

@@ -146,6 +146,21 @@ To reload the configuration from within the database, you can use the ``NOTIFY``
 List of parameters
 ==================
 
+.. _admin-server-host:
+
+admin-server-host
+-----------------
+
+ =============== =======================
+ **Type** String
+ **Default** `server-host` value
+ **Reloadable** N
+ **Environment** PGRST_ADMIN_SERVER_HOST
+ **In-Database** `n/a`
+ =============== =======================
+
+ Specifies the host for the :ref:`admin_server`. Defaults to :ref:`server-host` value.
+
 .. _admin-server-port:
 
 admin-server-port

src/PostgREST/AppState.hs

@@ -192,7 +192,8 @@ initSockets AppConfig{..} = do
  cfg'uspm = configServerUnixSocketMode
  cfg'host = configServerHost
  cfg'port = configServerPort
- cfg'adminport = configAdminServerPort
+ cfg'adminHost = configAdminServerHost
+ cfg'adminPort = configAdminServerPort
 
  sock <- case cfg'usp of
  -- I'm not using `streaming-commons`' bindPath function here because it's not defined for Windows,
@@ -210,9 +211,9 @@ initSockets AppConfig{..} = do
  pure (num, sock)
  pure sock
 
- adminSock <- case cfg'adminport of
+ adminSock <- case cfg'adminPort of
  Just adminPort -> do
- adminSock <- bindPortTCP adminPort (fromString $ T.unpack cfg'host)
+ adminSock <- bindPortTCP adminPort (fromString $ T.unpack cfg'adminHost)
  pure $ Just adminSock
  Nothing -> pure Nothing
 

src/PostgREST/Config.hs

@@ -106,6 +106,7 @@ data AppConfig = AppConfig
  , configServerTimingEnabled :: Bool
  , configServerUnixSocket :: Maybe FilePath
  , configServerUnixSocketMode :: FileMode
+ , configAdminServerHost :: Text
  , configAdminServerPort :: Maybe Int
  , configRoleSettings :: RoleSettings
  , configRoleIsoLvl :: RoleIsolationLvl
@@ -176,6 +177,7 @@ toText conf =
  ,("server-timing-enabled", T.toLower . show . configServerTimingEnabled)
  ,("server-unix-socket", q . maybe mempty T.pack . configServerUnixSocket)
  ,("server-unix-socket-mode", q . T.pack . showSocketMode)
+ ,("admin-server-host", q . configAdminServerHost)
  ,("admin-server-port", maybe "\"\"" show . configAdminServerPort)
  ]
 
@@ -276,12 +278,14 @@ parser optPath env dbSettings roleSettings roleIsolationLvl =
  <*> (fromMaybe False <$> optBool "openapi-security-active")
  <*> parseOpenAPIServerProxyURI "openapi-server-proxy-uri"
  <*> parseCORSAllowedOrigins "server-cors-allowed-origins"
- <*> (fromMaybe "!4" <$> optString "server-host")
+ <*> (defaultServerHost <$> optString "server-host")
  <*> (fromMaybe 3000 <$> optInt "server-port")
  <*> (fmap (CI.mk . encodeUtf8) <$> optString "server-trace-header")
  <*> (fromMaybe False <$> optBool "server-timing-enabled")
  <*> (fmap T.unpack <$> optString "server-unix-socket")
  <*> parseSocketFileMode "server-unix-socket-mode"
+ <*> (defaultServerHost <$> optWithAlias (optString "admin-server-host")
+ (optString "server-host"))
  <*> optInt "admin-server-port"
  <*> pure roleSettings
  <*> pure roleIsolationLvl
@@ -412,6 +416,9 @@ parser optPath env dbSettings roleSettings roleIsolationLvl =
 
  defaultHoistedAllowList = ["statement_timeout","plan_filter.statement_cost_limit","default_transaction_isolation"]
 
+ defaultServerHost :: Maybe Text -> Text
+ defaultServerHost = fromMaybe "!4"
+
 -- | Read the JWT secret from a file if configJwtSecret is actually a
 -- filepath(has @ as its prefix). To check if the JWT secret is provided is
 -- in fact a file path, it must be decoded as 'Text' to be processed.

test/io/configs/expected/aliases.config

@@ -35,4 +35,5 @@ server-trace-header = ""
 server-timing-enabled = false
 server-unix-socket = ""
 server-unix-socket-mode = "660"
+admin-server-host = "!4"
 admin-server-port = ""

test/io/configs/expected/boolean-numeric.config

@@ -35,4 +35,5 @@ server-trace-header = ""
 server-timing-enabled = false
 server-unix-socket = ""
 server-unix-socket-mode = "660"
+admin-server-host = "!4"
 admin-server-port = ""

test/io/configs/expected/boolean-string.config

@@ -35,4 +35,5 @@ server-trace-header = ""
 server-timing-enabled = false
 server-unix-socket = ""
 server-unix-socket-mode = "660"
+admin-server-host = "!4"
 admin-server-port = ""

test/io/configs/expected/defaults.config

@@ -35,4 +35,5 @@ server-trace-header = ""
 server-timing-enabled = false
 server-unix-socket = ""
 server-unix-socket-mode = "660"
+admin-server-host = "!4"
 admin-server-port = ""

test/io/configs/expected/no-defaults-with-db-other-authenticator.config

@@ -35,6 +35,7 @@ server-trace-header = "traceparent"
 server-timing-enabled = true
 server-unix-socket = "/tmp/pgrst_io_test.sock"
 server-unix-socket-mode = "777"
+admin-server-host = "127.0.0.1"
 admin-server-port = 3001
 app.settings.test = "test"
 app.settings.test2 = "test"

test/io/configs/expected/no-defaults-with-db.config

@@ -35,6 +35,7 @@ server-trace-header = "CF-Ray"
 server-timing-enabled = false
 server-unix-socket = "/tmp/pgrst_io_test.sock"
 server-unix-socket-mode = "777"
+admin-server-host = "127.0.0.1"
 admin-server-port = 3001
 app.settings.test = "test"
 app.settings.test2 = "test"

test/io/configs/expected/no-defaults.config

@@ -35,6 +35,7 @@ server-trace-header = "X-Request-Id"
 server-timing-enabled = true
 server-unix-socket = "/tmp/pgrst_io_test.sock"
 server-unix-socket-mode = "777"
+admin-server-host = "127.0.0.1"
 admin-server-port = 3001
 app.settings.test = "test"
 app.settings.test2 = "test"

test/io/configs/expected/types.config

@@ -35,5 +35,6 @@ server-trace-header = ""
 server-timing-enabled = false
 server-unix-socket = ""
 server-unix-socket-mode = "660"
+admin-server-host = "!4"
 admin-server-port = ""
 app.settings.test = "Bool False"

test/io/configs/no-defaults-env.yaml

@@ -38,4 +38,5 @@ PGRST_SERVER_TRACE_HEADER: X-Request-Id
 PGRST_SERVER_TIMING_ENABLED: true
 PGRST_SERVER_UNIX_SOCKET: /tmp/pgrst_io_test.sock
 PGRST_SERVER_UNIX_SOCKET_MODE: 777
+PGRST_ADMIN_SERVER_HOST: 127.0.0.1
 PGRST_ADMIN_SERVER_PORT: 3001

test/io/configs/no-defaults.config

@@ -36,5 +36,6 @@ server-timing-enabled = true
 server-unix-socket = "/tmp/pgrst_io_test.sock"
 server-unix-socket-mode = "777"
 admin-server-port = 3001
+admin-server-host = "127.0.0.1"
 app.settings.test = "test"
 app.settings.test2 = "test"

test/io/db_config.sql

@@ -35,6 +35,7 @@ CREATE DATABASE other;
 ALTER ROLE db_config_authenticator IN DATABASE other SET pgrst.db_max_rows = '1111';
 
 -- non-reloadable configs
+ALTER ROLE db_config_authenticator SET pgrst.admin_server_host = 'ignored';
 ALTER ROLE db_config_authenticator SET pgrst.admin_server_port = 'ignored';
 ALTER ROLE db_config_authenticator SET pgrst.db_channel = 'ignored';
 ALTER ROLE db_config_authenticator SET pgrst.db_channel_enabled = 'ignored';

test/spec/SpecHelper.hs

@@ -150,6 +150,7 @@ baseCfg = let secret = Just $ encodeUtf8 "reallyreallyreallyreallyverysafe" in
  , configServerUnixSocketMode = 432
  , configDbTxAllowOverride = True
  , configDbTxRollbackAll = True
+ , configAdminServerHost = "localhost"
  , configAdminServerPort = Nothing
  , configRoleSettings = mempty
  , configRoleIsoLvl = mempty