coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Accept a brokered libpq environment as connection information
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
AUDIT-WP-0005-T02. The rapp-postgres credential playbook has the
railiance-platform broker inject PGUSER/PGPASSWORD/PGHOST/PGPORT/PGDATABASE
into the child process. audit-core only accepted AUDIT_CORE_DATABASE_URL, so
consuming a brokered lease would have meant assembling a DSN by hand from the
injected variables - putting the credential back into audit-core's own
configuration, which is what the lane exists to avoid.

An empty conninfo lets libpq read those variables directly, so a brokered lease
now needs no DSN at all. AUDIT_CORE_DATABASE_URL still works for local and test
use. Missing both is a clear startup error naming each option.

Tests 80 -> 82.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-11 23:24:25 +02:00
parent ec8bacbdeb
commit fc48378a3f
4 changed files with 67 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

14
audit_core/ingestion.py
View file

@ -480,13 +480,17 @@ def build_backend() -> IdempotentAuditBackend:
the wrong store.
"""
url = os.environ.get("AUDIT_CORE_DATABASE_URL")
if url:
brokered = bool(os.environ.get("PGHOST") and os.environ.get("PGUSER"))
if url or brokered:
from audit_core.postgres_backend import PostgresAuditBackend
retention = os.environ.get("AUDIT_CORE_RETENTION_DAYS")
log.info("custody backend: postgresql")
log.info(
"custody backend: postgresql (%s)",
"AUDIT_CORE_DATABASE_URL" if url else "brokered libpq environment",
)
return PostgresAuditBackend(
url,
url or "",
schema=os.environ.get("AUDIT_CORE_DATABASE_SCHEMA", "audit_core"),
retention_days=int(retention) if retention else None,
max_size=int(os.environ.get("AUDIT_CORE_DB_POOL_MAX", "8")),
@ -496,8 +500,8 @@ def build_backend() -> IdempotentAuditBackend:
)
path = os.environ.get("AUDIT_CORE_DATABASE_PATH", "/data/audit-core.db")
log.warning(
"custody backend: sqlite at %s — AUDIT_CORE_DATABASE_URL is unset, so this "
"is not the production store", path,
"custody backend: sqlite at %s — neither AUDIT_CORE_DATABASE_URL nor a "
"brokered PG* environment is set, so this is not the production store", path,
)
return SQLiteAuditBackend(path)