diff --git a/src/PostgREST/CLI.hs b/src/PostgREST/CLI.hs index aa3a1cd85..a635aa081 100644 --- a/src/PostgREST/CLI.hs +++ b/src/PostgREST/CLI.hs @@ -1,6 +1,4 @@ -{-# LANGUAGE LambdaCase #-} {-# LANGUAGE NamedFieldPuns #-} -{-# LANGUAGE QuasiQuotes #-} {-# LANGUAGE RecordWildCards #-} module PostgREST.CLI ( main @@ -15,8 +13,6 @@ import qualified Data.ByteString.Lazy as LBS import qualified Hasql.Transaction.Sessions as SQL import qualified Options.Applicative as O -import Text.Heredoc (str) - import PostgREST.AppState (AppState) import PostgREST.Config (AppConfig (..)) import PostgREST.Observation (Observation (..)) @@ -116,7 +112,7 @@ readCLIShowHelp = <> O.help "Show the version information" exampleParser = - O.infoOption exampleConfigFile $ + O.infoOption Config.exampleConfigFile $ O.long "example" <> O.short 'e' <> O.help "Show an example configuration file" @@ -146,118 +142,3 @@ readCLIShowHelp = O.flag (Run CmdRun) (Client CmdReady) $ O.long "ready" <> O.help "Checks the health of PostgREST by doing a request on the admin server /ready endpoint" - - -exampleConfigFile :: [Char] -exampleConfigFile = - [str|## Admin server used for checks. It's disabled by default unless a port is specified. - |# admin-server-port = 3001 - | - |## The database role to use when no client authentication is provided - |# db-anon-role = "anon" - | - |## Notification channel for reloading the schema cache - |db-channel = "pgrst" - | - |## Enable or disable the notification channel - |db-channel-enabled = true - | - |## Enable in-database configuration - |db-config = true - | - |## Function for in-database configuration - |## db-pre-config = "postgrest.pre_config" - | - |## Extra schemas to add to the search_path of every request - |db-extra-search-path = "public" - | - |## Limit rows in response - |# db-max-rows = 1000 - | - |## Allow getting the EXPLAIN plan through the `Accept: application/vnd.pgrst.plan` header - |# db-plan-enabled = false - | - |## Number of open connections in the pool - |db-pool = 10 - | - |## Time in seconds to wait to acquire a slot from the connection pool - |# db-pool-acquisition-timeout = 10 - | - |## Time in seconds after which to recycle pool connections - |# db-pool-max-lifetime = 1800 - | - |## Time in seconds after which to recycle unused pool connections - |# db-pool-max-idletime = 30 - | - |## Allow automatic database connection retrying - |# db-pool-automatic-recovery = true - | - |## Stored proc to exec immediately after auth - |# db-pre-request = "stored_proc_name" - | - |## Enable or disable prepared statements. disabling is only necessary when behind a connection pooler. - |## When disabled, statements will be parametrized but won't be prepared. - |db-prepared-statements = true - | - |## The name of which database schema to expose to REST clients - |db-schemas = "public" - | - |## How to terminate database transactions - |## Possible values are: - |## commit (default) - |## Transaction is always committed, this can not be overriden - |## commit-allow-override - |## Transaction is committed, but can be overriden with Prefer tx=rollback header - |## rollback - |## Transaction is always rolled back, this can not be overriden - |## rollback-allow-override - |## Transaction is rolled back, but can be overriden with Prefer tx=commit header - |db-tx-end = "commit" - | - |## The standard connection URI format, documented at - |## https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING - |db-uri = "postgresql://" - | - |# jwt-aud = "your_audience_claim" - | - |## Jspath to the role claim key - |jwt-role-claim-key = ".role" - | - |## Choose a secret, JSON Web Key (or set) to enable JWT auth - |## (use "@filename" to load from separate file) - |# jwt-secret = "secret_with_at_least_32_characters" - |jwt-secret-is-base64 = false - | - |## Enables JWT Cache and sets its max size, disables caching with 0 - |# jwt-cache-max-entries = 0 - | - |## Logging level, the admitted values are: crit, error, warn, info and debug. - |log-level = "error" - | - |## Log the requested SQL query at the current log-level. - |log-query = "disabled" - | - |## Determine if the OpenAPI output should follow or ignore role privileges or be disabled entirely. - |## Admitted values: follow-privileges, ignore-privileges, disabled - |openapi-mode = "follow-privileges" - | - |## Base url for the OpenAPI output - |openapi-server-proxy-uri = "" - | - |## Configurable CORS origins - |# server-cors-allowed-origins = "" - | - |server-host = "!4" - |server-port = 3000 - | - |## Allow getting the request-response timing information through the `Server-Timing` header - |server-timing-enabled = false - | - |## Unix socket location - |## if specified it takes precedence over server-port - |# server-unix-socket = "/tmp/pgrst.sock" - | - |## Unix socket file mode - |## When none is provided, 660 is applied by default - |# server-unix-socket-mode = "660" - |] diff --git a/src/PostgREST/Config.hs b/src/PostgREST/Config.hs index c316812e3..8f629cda9 100644 --- a/src/PostgREST/Config.hs +++ b/src/PostgREST/Config.hs @@ -27,6 +27,7 @@ module PostgREST.Config , parseSecret , addFallbackAppName , addTargetSessionAttrs + , exampleConfigFile ) where import qualified Data.Aeson as JSON @@ -35,6 +36,7 @@ import qualified Data.ByteString.Base64 as B64 import qualified Data.CaseInsensitive as CI import qualified Data.Configurator as C import qualified Data.Map.Strict as M +import qualified Data.String as S import qualified Data.Text as T import qualified Data.Text.Encoding as T import qualified Jose.Jwa as JWT @@ -611,3 +613,118 @@ addConnStringOption dbUri key val = dbUri <> uriFmt = key <> "=" <> toS (escapeURIString isUnescapedInURIComponent $ toS val) keyValFmt = key <> "=" <> "'" <> T.replace "'" "\\'" val <> "'" lookAtOptions x = T.breakOn "?" . snd $ T.breakOnEnd "@" x -- start from after `@` to not mess passwords that include `?`, see https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING-URIS + +-- | Example config file displayed on postgrest "--example" flag +exampleConfigFile :: [Char] +exampleConfigFile = S.unlines + [ "## Admin server used for checks. It's disabled by default unless a port is specified." + , "# admin-server-port = 3001" + , "" + , "## The database role to use when no client authentication is provided" + , "# db-anon-role = \"anon\"" + , "" + , "## Notification channel for reloading the schema cache" + , "db-channel = \"pgrst\"" + , "" + , "## Enable or disable the notification channel" + , "db-channel-enabled = true" + , "" + , "## Enable in-database configuration" + , "db-config = true" + , "" + , "## Function for in-database configuration" + , "## db-pre-config = \"postgrest.pre_config\"" + , "" + , "## Extra schemas to add to the search_path of every request" + , "db-extra-search-path = \"public\"" + , "" + , "## Limit rows in response" + , "# db-max-rows = 1000" + , "" + , "## Allow getting the EXPLAIN plan through the `Accept: application/vnd.pgrst.plan` header" + , "# db-plan-enabled = false" + , "" + , "## Number of open connections in the pool" + , "db-pool = 10" + , "" + , "## Time in seconds to wait to acquire a slot from the connection pool" + , "# db-pool-acquisition-timeout = 10" + , "" + , "## Time in seconds after which to recycle pool connections" + , "# db-pool-max-lifetime = 1800" + , "" + , "## Time in seconds after which to recycle unused pool connections" + , "# db-pool-max-idletime = 30" + , "" + , "## Allow automatic database connection retrying" + , "# db-pool-automatic-recovery = true" + , "" + , "## Stored proc to exec immediately after auth" + , "# db-pre-request = \"stored_proc_name\"" + , "" + , "## Enable or disable prepared statements. disabling is only necessary when behind a connection pooler." + , "## When disabled, statements will be parametrized but won't be prepared." + , "db-prepared-statements = true" + , "" + , "## The name of which database schema to expose to REST clients" + , "db-schemas = \"public\"" + , "" + , "## How to terminate database transactions" + , "## Possible values are:" + , "## commit (default)" + , "## Transaction is always committed, this can not be overriden" + , "## commit-allow-override" + , "## Transaction is committed, but can be overriden with Prefer tx=rollback header" + , "## rollback" + , "## Transaction is always rolled back, this can not be overriden" + , "## rollback-allow-override" + , "## Transaction is rolled back, but can be overriden with Prefer tx=commit header" + , "db-tx-end = \"commit\"" + , "" + , "## The standard connection URI format, documented at" + , "## https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING" + , "db-uri = \"postgresql://\"" + , "" + , "# jwt-aud = \"your_audience_claim\"" + , "" + , "## Jspath to the role claim key" + , "jwt-role-claim-key = \".role\"" + , "" + , "## Choose a secret, JSON Web Key (or set) to enable JWT auth" + , "## (use \"@filename\" to load from separate file)" + , "# jwt-secret = \"secret_with_at_least_32_characters\"" + , "jwt-secret-is-base64 = false" + , "" + , "## Enables JWT Cache and sets its max size, disables caching with 0" + , "# jwt-cache-max-entries = 0" + , "" + , "## Logging level, the admitted values are: crit, error, warn, info and debug." + , "log-level = \"error\"" + , "" + , "## Log the SQL query at the current log-level." + , "log-query = \"disabled\"" + , "" + , "## Determine if the OpenAPI output should follow or ignore role privileges or be disabled entirely." + , "## Admitted values: follow-privileges, ignore-privileges, disabled" + , "openapi-mode = \"follow-privileges\"" + , "" + , "## Base url for the OpenAPI output" + , "openapi-server-proxy-uri = \"\"" + , "" + , "## Configurable CORS origins" + , "# server-cors-allowed-origins = \"\"" + , "" + , "server-host = \"!4\"" + , "server-port = 3000" + , "" + , "## Allow getting the request-response timing information through the `Server-Timing` header" + , "server-timing-enabled = false" + , "" + , "## Unix socket location" + , "## if specified it takes precedence over server-port" + , "# server-unix-socket = \"/tmp/pgrst.sock\"" + , "" + , "## Unix socket file mode" + , "## When none is provided, 660 is applied by default" + , "# server-unix-socket-mode = \"660\"" + ]