From 5eeb3a75b26d8f8a3565b43e2f0d324d8894fb44 Mon Sep 17 00:00:00 2001 From: Joe Nelson Date: Fri, 3 Oct 2014 13:45:02 -0700 Subject: [PATCH 1/2] Regenerate ssl cert specifically for localhost --- README.md | 20 +++++++++++++++++++- test/test.crt | 30 ++++++++++++------------------ test/test.key | 38 +++++++++++++------------------------- 3 files changed, 44 insertions(+), 44 deletions(-) diff --git a/README.md b/README.md index 3973d7f55..66585ff16 100644 --- a/README.md +++ b/README.md @@ -12,9 +12,19 @@ cabal install -j --enable-tests Example usage: ```sh -dbapi -p 3000 -d postgres://[user]:@localhost:5432/[database] +cabal run -p 3000 -d postgres://[auth-role]:@localhost:5432/[database] -a [anonymous-role] ``` +You will need to provide two database roles (which are allowed to +be the same). One is called the authenticator role (`auth-role` +above) which should have enough privileges to read the `auth` table +in the `dbapi` schema if you intend to support multi-user applications. + +The other role is for anonymous access (`anonymous-role` above). +Immediately upon acceping any unauthenticated HTTP connection dbapi +assumes this role in its queries to postgres. Give this role as +much or little permissions as you would like. + ### Running tests ```sh @@ -23,3 +33,11 @@ createdb -O dbapi_test -U postgres dbapi_test cabal test --show-details=always --test-options="--color" ``` + +### Accessing server on localhost + +Dbapi permits only secure https access. By default it uses a +self-signed key which will cause Chrome and other rest clients to +complain. You will need to configure your system to trust this key. +On mac follow [these +instructions](http://www.robpeck.com/2010/10/google-chrome-mac-os-x-and-self-signed-ssl-certificates/). diff --git a/test/test.crt b/test/test.crt index 545046da1..8de4a6729 100644 --- a/test/test.crt +++ b/test/test.crt @@ -1,20 +1,14 @@ -----BEGIN CERTIFICATE----- -MIIDRDCCAiwCCQD/S2JyvJS0tjANBgkqhkiG9w0BAQUFADBkMQswCQYDVQQGEwJV -UzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzET -MBEGA1UEChMKTG9vcCBSZWN1cjETMBEGA1UEAxMKSm9lIE5lbHNvbjAeFw0xNDA5 -MjkxODU2MTFaFw0xNTA5MjkxODU2MTFaMGQxCzAJBgNVBAYTAlVTMRMwEQYDVQQI -EwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRMwEQYDVQQKEwpM -b29wIFJlY3VyMRMwEQYDVQQDEwpKb2UgTmVsc29uMIIBIjANBgkqhkiG9w0BAQEF -AAOCAQ8AMIIBCgKCAQEAveoymmQBbtw9CqgWRIuV4YSxqRqitew6EmGdBcrz5hii -n78KwpB6c3U5pQknTh+eVDiifB3CBghC9ns5XiCMseXbaKaliJFo6BTyAWglkk12 -ckbqodzceBqeCiRDZnHXgA17fTnxS8igw2Ov1pv1aKdoW+FO9aSqCetKAm0xsDfz -Mfq9XBNJ4eN/aBxJCFS4vO0HFoFtWAAFUF4/fGoAZv65rNkR74Z/y26gJ58FKq6i -NaUnBgZgZ+5Odi9ZTv+yZdIP6Abl3iC85S7vCtcRNWlcphhC6pFv7sLvurzKd2In -l2I/iwSHm+La5QVnkS182EMe+IAZYyIVWkP9LEHRHwIDAQABMA0GCSqGSIb3DQEB -BQUAA4IBAQAPC/8nMuq5Gvd0Ds880jpm6NnSeU0AiRsgmIwmaawofVYOze0MT+Ix -/i9rDxo8LxwptEZCYXO6DEZq8yjSVGGccM+VOcj7bfxh2UqAfP6j+6H836nOY7Bk -FDs2Q1sazx+YmsxaBLyyOoBK+6qDqDm4B4Bo3cl8s4eZf2i0yC0sOuO0PYyreX7y -jFk7ELS7uA8ch1fPqp0WPn8rYvYUZKSKa7Q2Qu0ai+bciAMLYQNkpYFwbfLLHXwN -/EqLAYrsGGiYU+VNtjrsknF0rxQieUQhoomdia/g3NMBoXSALqJoOaETW3e2DLHQ -usaxg3L90+kmZDjfDS4DTH4gCx5pL0L1 +MIICLTCCAZYCCQCj6GtISfdwNjANBgkqhkiG9w0BAQUFADBbMQswCQYDVQQGEwJV +UzELMAkGA1UECBMCQ0ExFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xEzARBgNVBAoT +Ckxvb3AgUmVjdXIxEjAQBgNVBAMTCWxvY2FsaG9zdDAeFw0xNDEwMDMyMDQyNDNa +Fw0xNTEwMDMyMDQyNDNaMFsxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEWMBQG +A1UEBxMNU2FuIEZyYW5jaXNjbzETMBEGA1UEChMKTG9vcCBSZWN1cjESMBAGA1UE +AxMJbG9jYWxob3N0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5gFnTRBge +mXdkCMD+OycujZrCWOOLIDBqRr7kDbxVXqz/TKHRVx6bz88g9egzvR2HLyA418kd +dAu+lMmjrRv/k0Lnk/UvC1aj0huoHpOVUgOwy3qS4cE663uU5qsrgf4RDP7bLDcQ +FDW02SQ2n5ryv8nB9TSYpvQvYPiTMMKdrwIDAQABMA0GCSqGSIb3DQEBBQUAA4GB +AAQwkC+GSaGArAKdMIqs8/55KAjyNd11MupiCWsu1cwBJ4QJc1PxrYOMLMYnU06J +I0v1bJ6mG06/Js0r2FHM0NXSQO+7DLPWu4LchoBgFt4ZRm2+GbLzFrfu41yn5mJN +VeUxCBQ9hOrE8Kwe+/9IUUVPxlISF+YHOyF3DxWUViak -----END CERTIFICATE----- diff --git a/test/test.key b/test/test.key index 0de5e6304..4e8faeca7 100644 --- a/test/test.key +++ b/test/test.key @@ -1,27 +1,15 @@ -----BEGIN RSA PRIVATE KEY----- -MIIEogIBAAKCAQEAveoymmQBbtw9CqgWRIuV4YSxqRqitew6EmGdBcrz5hiin78K -wpB6c3U5pQknTh+eVDiifB3CBghC9ns5XiCMseXbaKaliJFo6BTyAWglkk12ckbq -odzceBqeCiRDZnHXgA17fTnxS8igw2Ov1pv1aKdoW+FO9aSqCetKAm0xsDfzMfq9 -XBNJ4eN/aBxJCFS4vO0HFoFtWAAFUF4/fGoAZv65rNkR74Z/y26gJ58FKq6iNaUn -BgZgZ+5Odi9ZTv+yZdIP6Abl3iC85S7vCtcRNWlcphhC6pFv7sLvurzKd2Inl2I/ -iwSHm+La5QVnkS182EMe+IAZYyIVWkP9LEHRHwIDAQABAoIBAGbG9qm9E1V2lQZO -Xvarf+pzEF6Ozp2bgPXvo7W91u6gSGohTmZrIAmZ2B9ra70IuXukxrJavGTdVbfk -ifBZtyqTVYE2JoFZCCgJJcsDHMonZ8GChXohd6L77KlaZKttUo23PixQDjjQE8iK -C2AeONpxNrX6oeuoOGlzzzKu+2P8g/s3PZT0W3KjiRYYTJOeU4giPvYTrCsNiOTq -ciaqT7XN/2tfE9xYvVTaHxFMtXRCKQ9u2yBTJ+QIGHuQaB2x0fwj4c98oQTY3ZqP -nE58p5duG/8nWItLrOwusV9e7hxXPC/qf/vgLUmNfRd0ES4iCIjCRDISpiUsuMdt -9i+W8cECgYEA7+4S6XLEZv/ADCxf4/ewAxcTyEt4mlRU5thrl2wONbNvyf/fiCxD -u4NylnLFCb+5TIqgD886TTGj2qAs2q/pyDLDGeD7tsdAi77FI67nT7ady45RmsGr -oe22M3klgYLsQbgrWOB2FVW6/Ii6wJ82zo6UICU6oAz3nQ2zHgL8sn8CgYEAyqKL -zM612Qm+Xx6YGuwr8cq77NhXABtlZMwZjb8Q/TvOlwdvH+ERFJsU8p7NXBEXD9vU -FXOZcHs+iCoMqOsE6V6iY3pvL3Q74PKx5UzB5kNXxdySWbIaRUZlSBFmzGC9/L6e -zfau6zwf1mn38agxv3fWNgTJryBQQ3oR5VX4UWECgYBI4RUnii/0ZW0thXEfKwZw -+dqNdbdNkZ40fLq5xR3P3BBx2GJK178/Px9YacZGPtGHWXhjNPwtpI10BEF7sAGg -SSMQQlHTZFTL3ge93gvvH7ZwtWs+SePbjPxSSFNHMsCW+d1Y4t2bf24L9XBcwEAC -oDaISSa0pRu1vgqRbDDb+wKBgAeMIFrjhCBuXXnbgNzX2Rcrbu52bF8jphYoB/eg -mzhjZuF3NGtijalP0WrsAUghltNPY8ncwWVQIdcegdQ01L0AelnsMIH6+VP6liet -QTebYISNH6JZoOLdqV4Sz9pi7BCi5PVU79TxK1poHgURN7Ei/IaMjRqJwJOS02HQ -XuxhAoGAZ89zIqlWUkl1jTvUEUMUljiZpCvM3oCWfnGHoLlg5b6G5AESUCTeNVWg -M3G7KBWJ8LzjezX1SUBP8gr1TZYlT15BXmpYAOrTGPBvsi8ajtvXWK+RO40ywAbp -zsSgwB4J8gaggb6z6XqbQhMeuNmhzKV4hHXy2Eu08ApgXuPIp7M= +MIICXQIBAAKBgQC5gFnTRBgemXdkCMD+OycujZrCWOOLIDBqRr7kDbxVXqz/TKHR +Vx6bz88g9egzvR2HLyA418kddAu+lMmjrRv/k0Lnk/UvC1aj0huoHpOVUgOwy3qS +4cE663uU5qsrgf4RDP7bLDcQFDW02SQ2n5ryv8nB9TSYpvQvYPiTMMKdrwIDAQAB +AoGAZZD0Haub9S0b5KayXMCwnFmmEaEvvR47xATGQgGPS8LRv9sKgp9LwA4RH7/k +imeSglD4OIdVs421XH0ExlxjBiV5EzTCgLUyKbfA//xUy9ggXD1Ks4vIHL0c1DM4 +g6/zylN7CQtt4Bb6YdWDSAUXIl3U5Dj1kG7BWuXfJTxCx7ECQQDyLxoQRNkPwKP/ +xeOqfCgwyD52rnUJ7g9UViFcCU2ZLLEYxE4b3FECcwhOfUlxYvKdOx03Qts0taow +dPU/BEXHAkEAxBVyKwTJ0T6rQmcQEx3WuaBhSjXgZigUN4OdXMg+LSO+1MON6Nhm +J9ociy+xvfd0Cf3yABaAEU/hZ+Pmk2DI2QJBAO/XU8F+3VQrXH7l9HSXJppBBRM1 +7HScDRRhhAIIuI+UYgJ8DjqrMpLxZu2MSBqBenHZ5DIhBMOrkVMR0PrKeWsCQCHh +gsSkIysgpP7oSALFmSCh8a2c+ZUtP7EH8NzjTLsH/iVNVOvy2FPygBQcvZ2RcF95 +naMeQCq9nrkQy/qTMqECQQDa1WjWS2ngwqGzHovqiKRg3lQ8MFNlvlStAQl8+9h0 +KJj8Rl6h+gO8eretBIe+y5j/hCC90xlJotzwO3jJF6Hc -----END RSA PRIVATE KEY----- From 6b325e01397ce48c867d39c1cac269c6e74a5fa1 Mon Sep 17 00:00:00 2001 From: Joe Nelson Date: Fri, 3 Oct 2014 13:56:02 -0700 Subject: [PATCH 2/2] Make the anonymous pg role a mandatory argument --- src/Main.hs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/Main.hs b/src/Main.hs index 631917791..147639af6 100644 --- a/src/Main.hs +++ b/src/Main.hs @@ -25,7 +25,7 @@ argParser = AppConfig <> help "path to SSL cert file") <*> strOption (long "sslkey" <> short 'k' <> metavar "PATH" <> value "test/test.key" <> help "path to SSL key file") - <*> strOption (long "anonymous" <> short 'a' <> metavar "ROLE" <> value "dbapi_anon" + <*> strOption (long "anonymous" <> short 'a' <> metavar "ROLE" <> help "postgres role to use for non-authenticated requests") main :: IO ()