From 1afff44c1343862c0b48d08aa1ba8ad60e1dea5a Mon Sep 17 00:00:00 2001 From: Navid Sassan Date: Tue, 27 Oct 2026 16:11:20 +0100 Subject: [PATCH] feat(roles/proxysql): follow upstream releases, update to ProxySQL 3.0.11 --- roles/proxysql/templates/etc/proxysql.cnf.j2 | 195 ++++++++++++++++++- tools/follow-upstream.yml | 20 ++ 2 files changed, 214 insertions(+), 1 deletion(-) diff --git a/roles/proxysql/templates/etc/proxysql.cnf.j2 b/roles/proxysql/templates/etc/proxysql.cnf.j2 index 643826f4b..a18d7a778 100644 --- a/roles/proxysql/templates/etc/proxysql.cnf.j2 +++ b/roles/proxysql/templates/etc/proxysql.cnf.j2 @@ -1,5 +1,6 @@ # {{ ansible_managed }} -# 2025061302 +# 2026102701 +{# Based on proxysql 3.0.11 #} #file proxysql.cfg @@ -37,6 +38,17 @@ datadir="/var/lib/proxysql" errorlog="/var/lib/proxysql/proxysql.log" +# Plugin chassis (v4.0+). Uncomment to load runtime-loadable +# extensions. Each entry is the absolute path to a .so file shipped +# under /usr/lib/proxysql/. Plugins are loaded in declaration order +# during startup; missing files cause the proxy to abort with an +# explanatory message. +# +# plugins=( +# "/usr/lib/proxysql/ProxySQL_MySQLX_Plugin.so" +# "/usr/lib/proxysql/ProxySQL_GenAI_Plugin.so" +# ) + admin_variables= { admin_credentials="{% for item in proxysql__admin_users %}{{ item["username"] }}:{{ item["password"] }};{% endfor %}{% if proxysql__cluster_user is defined and proxysql__cluster_user | length %}{{ proxysql__cluster_user["username"] }}:{{ proxysql__cluster_user["password"] }}{% endif %}" @@ -79,6 +91,35 @@ mysql_variables= commands_stats=true sessions_sort=true connect_retries_on_failure=10 + +##################################################################### +# Pass-through authentication (opt-in, off by default). +# +# When enabled, ProxySQL can authenticate a client to the backend +# without a pre-provisioned password in mysql_users: it intercepts +# the cleartext password sent during the caching_sha2_password +# full-auth exchange, probes a backend with it, and on success +# caches the credential in memory for the next connect. See +# doc/internal/passthrough_authentication.md for the design. +# +# IMPORTANT: enabling passthrough_auth_unknown_users WITHOUT setting +# passthrough_auth_username_pattern lets ANY username be probed +# against the backend. ProxySQL emits a startup warning when that +# combination is published; treat the warning seriously. +##################################################################### +# passthrough_auth_enabled=false # master gate; nothing below applies until true +# passthrough_auth_empty_password=true # honor mysql_users rows with password='' as pass-through opt-in +# passthrough_auth_unknown_users=false # also allow usernames NOT in mysql_users (gated by passthrough_default_hg) +# passthrough_auth_require_tls=true # refuse to send AuthMoreData{0x04} over non-TLS client connections +# passthrough_default_hg=0 # hostgroup used for unknown-user probes +# passthrough_default_schema="" # default schema for unknown-user sessions (falls back to default_schema if empty) +# passthrough_auth_cache_ttl_s=0 # 0 = entries never expire; nonzero = lazy eviction window in seconds +# passthrough_auth_max_inflight_probes=100 # concurrent probes cap (DoS / thundering-herd protection) +# passthrough_auth_username_pattern="" # re2 regex; empty = allow all (HIGHLY recommended to set when unknown_users=true) +# passthrough_auth_max_failures_per_user=3 # per-user sliding-window threshold +# passthrough_auth_max_failures_per_ip=10 # per-source-IP sliding-window threshold +# passthrough_auth_failure_window_s=60 # sliding-window size for both counters +# passthrough_auth_failure_map_cap=100000 # max distinct keys retained in failure deques (defense-in-depth) } @@ -249,6 +290,158 @@ proxysql_servers = ) +############################################################################# +# The sections below also round-trip through the configuration file, i.e. +# they are emitted by SAVE CONFIG TO FILE / SELECT CONFIG INTO OUTFILE and +# consumed by LOAD MYSQL|PGSQL QUERY RULES FROM CONFIG, LOAD MYSQL|PGSQL +# FIREWALL FROM CONFIG, and LOAD MYSQL|PGSQL SERVERS FROM CONFIG (issue #3468). +# They are shown here commented out; in normal operation they are managed via +# the admin interface and persisted with SAVE ... TO DISK. Each pgsql_* variant +# mirrors its mysql_* sibling (a PostgreSQL section keys on `database` where the +# MySQL one keys on `schemaname`). +############################################################################# + +# Fast-routing query rules: constant-time (username, schema) -> hostgroup routing. +mysql_query_rules_fast_routing: +( +# { +# username="app1" +# schemaname="shard1" +# flagIN=0 +# destination_hostgroup=10 +# comment="" +# } +) + +pgsql_query_rules_fast_routing: +( +# { +# username="app1" +# database="shard1" +# flagIN=0 +# destination_hostgroup=10 +# comment="" +# } +) + +# SQL firewall whitelist. mode is one of: OFF | DETECTING | PROTECTING. +mysql_firewall_whitelist_users: +( +# { +# active=1 +# username="app1" +# client_address="" +# mode="DETECTING" +# comment="" +# } +) + +mysql_firewall_whitelist_rules: +( +# { +# active=1 +# username="app1" +# client_address="" +# schemaname="shard1" +# flagIN=0 +# digest="0xE8CF0E5469C2D74C" +# comment="" +# } +) + +mysql_firewall_whitelist_sqli_fingerprints: +( +# { +# active=1 +# fingerprint="EnkfB" +# } +) + +pgsql_firewall_whitelist_users: +( +# { +# active=1 +# username="app1" +# client_address="" +# mode="DETECTING" +# comment="" +# } +) + +pgsql_firewall_whitelist_rules: +( +# { +# active=1 +# username="app1" +# client_address="" +# database="shard1" +# flagIN=0 +# digest="0xE8CF0E5469C2D74C" +# comment="" +# } +) + +pgsql_firewall_whitelist_sqli_fingerprints: +( +# { +# active=1 +# fingerprint="EnkfB" +# } +) + +# Per-server backend SSL parameters. NOTE: the MySQL and PostgreSQL tables have +# different columns -- the MySQL section carries ssl_capath / ssl_cipher / +# tls_version, while the PostgreSQL section carries ssl_protocol_version_range. +mysql_servers_ssl_params: +( +# { +# hostname="127.0.0.1" +# port=3306 +# username="" +# ssl_ca="" +# ssl_cert="" +# ssl_key="" +# ssl_capath="" +# ssl_crl="" +# ssl_crlpath="" +# ssl_cipher="" +# tls_version="" +# comment="" +# } +) + +pgsql_servers_ssl_params: +( +# { +# hostname="127.0.0.1" +# port=5432 +# username="" +# ssl_ca="" +# ssl_cert="" +# ssl_key="" +# ssl_crl="" +# ssl_crlpath="" +# ssl_protocol_version_range="" +# comment="" +# } +) + +# Per-hostgroup attributes for PostgreSQL (mirrors mysql_hostgroup_attributes). +pgsql_hostgroup_attributes: +( +# { +# hostgroup_id=10 +# max_num_online_servers=1000000 +# autocommit=-1 +# free_connections_pct=10 +# multiplex=1 +# hostgroup_settings="" +# servers_defaults="" +# comment="" +# } +) + + # http://www.hyperrealm.com/libconfig/libconfig_manual.html#Configuration-File-Grammar # # Below is the BNF grammar for configuration files. Comments and include directives are not part of the grammar, so they are not included here. diff --git a/tools/follow-upstream.yml b/tools/follow-upstream.yml index 3375a24ad..94ba28ea0 100644 --- a/tools/follow-upstream.yml +++ b/tools/follow-upstream.yml @@ -154,3 +154,23 @@ influxdb: - package: 'influxdb' path: '/etc/influxdb/influxdb.conf' template: 'roles/influxdb/templates/etc/influxdb/influxdb.conf.j2' + +# Install scripts (proxysql 3.0.11, RPM): create the user and apply the systemd preset to +# proxysql.service on the first installation, never touch the templated file. One +# template serves 2.7 and 3.0. The DEB is not checked: the role supports RHEL only, and +# upstream's flat APT repository (` ./`) is not supported by this tool. +proxysql: + upstream: + - 'sysown/proxysql' + series_parts: 2 + gpg_key: 'https://repo.proxysql.com/ProxySQL/proxysql-{series}.x/repo_pub_key' + rpm_repo: 'https://repo.proxysql.com/ProxySQL/proxysql-{series}.x/centos/9/' + files: + - package: 'proxysql' + path: '/etc/proxysql.cnf' + template: 'roles/proxysql/templates/etc/proxysql.cnf.j2' + ignore: + # the packaged defaults are used + - '/etc/logrotate.d/proxysql' + - '/etc/systemd/system/proxysql-initial.service' + - '/etc/systemd/system/proxysql.service'