pgproxy

README

pgproxy

PGProxy is a proxy for the Postgres wire protocol that allows for customizing authentication and backend selection by overriding the startup message flow.

Once authenticated, PGProxy falls back to being a dumb proxy that simple shuffles bytes back and forth.

Internally pgproxy vendors simplified versions of the excellent pgproto3 and pgio.

Documentation

Index

• Variables
• type AuthData
• type BackendData
• type CancelRequest
• type FrontendMessage
• type Proxy
  • func (p *Proxy) BackendAuth(backend io.ReadWriter, tlsCfg *tls.Config, auth *AuthData) (*BackendData, error)
  • func (p *Proxy) Data(ctx context.Context) error
  • func (p *Proxy) FrontendAuth(frontend io.ReadWriter, tlsCfg *tls.Config, requirePassword bool) (*AuthData, error)
• type SimpleConfig
  • func (cfg *SimpleConfig) Proxy(ctx context.Context, frontend, backend io.ReadWriter) error
• type StartupMessage

Variables

var ErrCancelled = errors.New("request cancelled")

ErrCancelled is reported when the proxy is closed due to requesting cancellation.

Types

type AuthData

type AuthData struct {
	Startup  FrontendMessage // *StartupMessage or *CancelRequest
	Database string
	Username string
	Password string // may be empty if ProxyConfig.RequirePassword is false
}

AuthData is the authentication data received from the frontend.

type BackendData

type BackendData struct {
	KeyData *pgproto3.BackendKeyData // may be nil
}

BackendData is the data reported from the backend after authentication is completed.

type CancelRequest

type CancelRequest = pgproto3.CancelRequest

type FrontendMessage

type FrontendMessage interface {
	pgproto3.FrontendMessage
}

FrontendMessage represents messages received from the frontend.

type Proxy

type Proxy struct {
	Debug bool
	// contains filtered or unexported fields
}

Proxy proxies the Postgres wire protocol between a client and a server, injecting custom behavior into the authentication and server selection at startup.

func (*Proxy) BackendAuth

func (p *Proxy) BackendAuth(backend io.ReadWriter, tlsCfg *tls.Config, auth *AuthData) (*BackendData, error)

BackendAuth performs the server-side authentication step, and reports any key data received from the server for use with cancellation requests.

func (*Proxy) Data

func (p *Proxy) Data(ctx context.Context) error

Data proxies the steady-state data between the frontend and backend once both sides are authenticated.

func (*Proxy) FrontendAuth

func (p *Proxy) FrontendAuth(frontend io.ReadWriter, tlsCfg *tls.Config, requirePassword bool) (*AuthData, error)

FrontendAuth performs the client-side authentication step, and reports the auth data received.

type SimpleConfig

type SimpleConfig struct {
	RequirePassword bool
	FrontendTLS     *tls.Config
	BackendTLS      *tls.Config
	Debug           bool
}

SimpleConfig provides a convenient approach to setting up most common proxy scenarios.

func (*SimpleConfig) Proxy

func (cfg *SimpleConfig) Proxy(ctx context.Context, frontend, backend io.ReadWriter) error

Proxy begins proxying from frontend to backend.

type StartupMessage

type StartupMessage = pgproto3.StartupMessage