Skip to content

feat(provision): listen on loopback, opt-in restart - #19

Draft
mrcsin wants to merge 20 commits into
password-hygienefrom
site-loopback-and-restart
Draft

mrcsin wants to merge 20 commits into
password-hygienefrom
site-loopback-and-restart

Conversation

@mrcsin

@mrcsin mrcsin commented Oct 19, 2026

Copy link
Copy Markdown
Member

Every client of the instance runs on the same Windows machine, and nothing on the operator network may reach the server. The restart that activates the new value has to happen somewhere the installer can drive.

  • site writes listen_addresses = 'localhost' with the other ALTER SYSTEM deltas. It is postmaster-context, so it lands in pending_restart like shared_buffers.
  • site --restart-service <name> restarts that Windows service only when settings wait for a restart, waits for the server to accept connections, then continues. Without the flag the run warns as before. CI's Linux job runs site against a service container the tool cannot restart, so the restart stays opt-in.

Plan: docs/plans/20261019-site-loopback-and-restart.md. Stacked on #17.

Verification:

  • Linux CI requires listen_addresses pending after the two site runs.
  • Windows CI runs site --restart-service postgresql-x64-17 against the runner's PostgreSQL 17, then checks SHOW listen_addresses and an empty pending_restart, then a second run that does not restart.

mrcsin added 20 commits October 19, 2026 14:39
Every client of the instance runs on the same Windows machine, and
nothing on the operator network may reach the server. site now writes
listen_addresses = 'localhost' with the other ALTER SYSTEM deltas; it
is postmaster-context, so it lands in pending_restart like
shared_buffers and the existing report covers it. The Linux CI job
requires the value pending after the two site runs, since its service
container is never restarted.
The installer needs site to restart the PostgreSQL service when the
tuning leaves settings waiting for a restart. The flag parses on every
platform; Options.Validate refuses it for bench, which applies no
server settings, and for a host other than localhost, 127.0.0.1 or
::1, since the restarted server listens on loopback only. Options
carries the command name so Validate can tell site from bench. The
restart itself lands in the next commit; until then the flag is
validated and ignored.
The tuning phase leaves shared_buffers and listen_addresses waiting
for a restart, so create and check ran against the old settings and
the run ended with a warning. With --restart-service the phase now
restarts the named Windows service through x/sys svc/mgr, waits for
the server to accept connections again, and re-reads pending_restart.

The service is checked before the first connection: a missing or
Disabled service, a stopped one, a missing right, or a non-Windows
build fails with nothing changed. Once Stop is accepted, Start is
sent on a context detached from the command's cancellation, so an
interrupt or a timeout never leaves the service stopped.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant