VPN ba ya hana psql: abokin cinikinka yana kira wani wuri
psql da abokin cinikin GUI na iya kiran wurare daban-daban daga na'ura ɗaya. Kwatanta host, socket, role da TLS kafin ka zargi VPN.
Duka abokan ciniki biyu suna kan kwamfutar tafi-da-gidanka ɗaya, suna wucewa ta rami ɗaya, kuma ɗayansu ne kawai ke haɗawa. Wannan kwatancen yana kama da hujja cewa VPN yana zaɓar wanda zai haɗa, alhali mafi yawan bayanin da ake samu shi ne cewa abokan cinikin biyu suna kiran wurare daban-daban. GUI yana riƙe da nasa host, port, role da saitunan TLS kuma yana gina hanyar SSH a hankali lokacin da yake buƙata, yayin da psql ke haɗa hanyar sadarwa daga tsoffin libpq waɗanda shell ɗinka mai yiwuwa ya riga ya saita. Sake yin hanyar da ke aiki al'amari ne na karanta saitunan GUI, ba sake shigar da ramin ba.
Tatsuniya: abokin ciniki ɗaya mai aiki yana tabbatar da hanyar
Idan GUI ya haɗa, ramin yana ɗaukar zirga-zirga, kuma wannan ne kawai abin da GUI ke tabbatarwa. Ba ya faɗin komai game da wace adireshi psql ke warwarewa, wace role yake tabbatarwa da ita, ko socket ɗin da yake buɗewa yana barin na'urar kwata-kwata. Hanyar an raba ta; sigogin ba a raba su.
Hanyar gida tana faɗaɗa tazara. GUI na iya haɗawa da 127.0.0.1 a kan port da ya tura ta SSH, kuma wannan mai sauraro yana wanzu ne kawai muddin zaman GUI yana gudana. psql da aka nufa zuwa localhost ba tare da hanyar ba yana samun haɗin da aka ƙi wanda ba shi da alaƙa da VPN.
Karanta wurin da GUI ke amfani da shi da gaske
Buɗe kaddarorin haɗin ka kwafa ƙima huɗu: host, port, database da role. Sannan nemi shafin rami, domin hanyar SSH tana mai da adireshin sirri zuwa port na gida kuma tana canza abin da za a faɗa wa psql.
| Setting | What the GUI holds | What psql uses when the value is absent |
|---|---|---|
| Destination | A saved hostname, sometimes behind a forward | A local Unix socket, not the remote endpoint |
| Port | The direct port or a forwarded local port | 5432, or the port from a service file |
| Role and database | Stored per connection profile | Your operating-system user name |
| TLS identity | Its own CA bundle and verification mode | Whatever PGSSLMODE or the service file says |
| Startup files | Not read at all | Read unless -X is passed |
Kowane layi yana kasawa a wani mataki daban, kuma saƙon da ka samu yana ambaton wannan matakin. Liƙa sunan abokantaka na bayanan da aka adana cikin psql ba ya ɗauke da ɗaya daga cikin ƙimomin da ke sama, kuma sunan sabis yana warwarewa ta fayil da terminal ba zai taɓa karantawa ba.
Abin da libpq ke gado daga shell ɗinka
psql ɗan ƙaramin abokin ciniki ne a kan libpq, kuma libpq yana karanta muhalli kafin ya karanta wani abu. Masu canji kamar PGHOST, PGHOSTADDR, PGPORT, PGDATABASE, PGUSER, PGSERVICE da PGSSLMODE kowanne yana iya juya wani ɓangare na haɗin. Ana gadonsu ne maimakon rubuta su, don haka babu abin da ke cikin umarnin da ka aiwatar da shi da ke nuna su. PGSSLMODE da aka fitar zai iya canza abin da abokin ciniki ke karɓa ba tare da wata kalma a layin umarni ba.
Biyu daga cikin waɗannan masu canji sun cancanci zato da farko. PGHOSTADDR yana bayar da manufa ta lamba wadda ke wuce warware suna yayin da sunan host har yanzu ke jagorantar asalin takardar shaida, kuma PGSERVICE yana ciro host, database da zaɓin TLS daga fayil ɗin sabis. Zubar da dukan muhalli don gyara wannan mummunar ɗabi'a ce, domin yana iya ƙunsar kalmomin sirri da alamun da ba su da alaƙa; a maimakon haka zaɓi masu canjin da suka damu da kai.
Barin duka host da hostaddr yana zaɓar socket na yankin Unix maimakon adireshin cibiyar sadarwa. Don haka kiran psql ba tare da -h zai iya yin nasara a gida, ko ya kasa da kuskuren socket, ba tare da taɓa hanyar da GUI ke amfani da ita ba.
Aika sigogin guda da hannu
Da ƙimar GUI a hannunka, miƙa su a bayyane ka tsallake fayil ɗin farawa wanda zai iya ƙara maye gurbi. Sigar haɗin da ke ƙasa misali ne: maye gurbin wurin, port, database da role da ƙimar da shugaban ka ya amince da su, kuma ka riƙe tsarin amincewa wanda ke aiki tukuna.
psql -X "host=db.internal.example port=6432 dbname=orders user=report_ro sslmode=verify-full connect_timeout=5"Abubuwa uku a cikin wannan umarnin da gangan ne. -X yana danne fayil ɗin farawa na psql, ko da yake bai danne muhallin libpq ko ma'anar sabis ba. connect_timeout=5 yana hana hanyar da babu kome rataya terminal na mintuna. sslmode=verify-full yana riƙe dubawa na takardar shaida da sunan host a kunne, wanda shi ne ainihin ɓangaren da mutane ke kashewa idan kuskuren TLS ya bayyana.
Idan wurin da aka amince yana bayan pooler, port 6432 da port 5432 na iya isa ga bayanai ɗaya ta asalin sabar daban-daban, kuma tabbatarwa na iya kasawa da sunan pooler maimakon na database. Gyara sunan a cikin sigar haɗin maimakon raunana yanayin.
Bari saƙon kuskure ya zaɓi mataki na gaba
Rubutun gazawar yana faɗin yadda ƙoƙarin ya yi nisa, kuma hakan ya fi kowane hasashe game da ramin. Sunan da ba zai warware ba yana kasawa kafin socket ya wanzu, ƙarewar lokaci yana nufin hanyar ko firewall ya jefar da fakiti, ƙi yana nufin wani abu ya amsa ya ƙi, kuma kuskuren tabbatarwa yana nufin cibiyar sadarwa ta riga ta yi aiki.
psql -X -w "host=db.internal.example port=6432 dbname=orders user=report_ro sslmode=verify-full connect_timeout=5" -c '\conninfo'
env | grep -E '^PG'
psql --versionKwatanta fitowar \conninfo da zaman GUI mai rai: host ɗaya, port ɗaya, role ɗaya, yanayin TLS ɗaya. Idan waɗannan huɗu suka yarda, VPN ba shi da wani abin bayani. Har sai sun yarda, kowane ƙarin canjin rami hasashe ne game da haɗin da terminal bai taɓa yi ba.