feat: 数据库对外访问文档 + 安全加固 + 仓库工程化 - #1
Conversation
新增能力与文档: - references/database-access.md: 数据库对外访问工作流(协议认知、内网>隧道>公网加固四级方案、域名连库与 Cloudflare 灰云、TLS 警告、pgweb/Adminer/PostgREST 指路) - safety-rules.md: 新增 --is-public 红线与"公开数据库端口标准流程"(内网>隧道>公网,永不默认公开) - SKILL.md: 路径 E 增加"对外访问"分支;触发描述追加扩容/绑域名/改 env/备份/回滚/查状态/暴露端口等动词 - cli-cheatsheet.md: 标注未实测 flag(--save-s3/--s3-storage-uuid/--retention-amount-local、deploy list json 字段名) - deploy-and-watch.sh: jq 字段过滤上方加核对注释 安全加固(review 发现的凭据泄露隐患): - 排障表移除"临时用 http://"的无条件建议,改为优先修 TLS 并警告 token 明文风险 - 元规则扩展为不外泄 -s/--show-sensitive 输出,连接串密码脱敏展示 仓库工程化: - LICENSE(MIT/2025/hifizz)、.gitignore、.github/workflows/shellcheck.yml(severity: warning) - README: 版本兼容声明占位 + 能做/不能做能力边界表 所有 scripts/*.sh 通过 shellcheck -S warning;SKILL.md 127 行(≤150) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f56334cc14
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - **Cloudflare Tunnel**：在 VPS 上跑 `cloudflared`，把数据库端口通过 Cloudflare 边缘暴露给指定的客户端；公网扫描器看不到你 VPS 上的开放端口。 | ||
| - **Tailscale / WireGuard**：把 VPS 和连库方加进同一个私有网络（tailnet），用 Tailscale 内网 IP（`100.x.x.x`）连库。零公网暴露，端对端加密。 | ||
|
|
||
| 优点：**公网端口扫描器看不到数据库端口**，流量加密，凭据不在公网明文裸奔。对 Vercel 这类无固定出口 IP 的平台，Cloudflare Tunnel 尤其合适。 |
There was a problem hiding this comment.
For Vercel clients this recommendation does not work for normal database connections: Cloudflare's arbitrary TCP docs require each connecting client to run cloudflared access tcp, but Vercel serverless/edge functions cannot keep that local TCP proxy running as a sidecar for a postgresql://... or MySQL client. In the Vercel case, following this path leaves the app unable to connect, so the doc should either avoid naming Vercel as a good fit for Cloudflare Tunnel TCP or describe a Vercel-compatible product/architecture.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
已采纳 👍 修复见 e393578（已推到本 PR）。
按建议采用「拆分 Vercel」而非整段删掉隧道方案：
- 决策表：把
Vercel / serverless·edge从隧道行拆出，单列并指向 HTTP 层。 - §2.2：标题改为「连库方能常驻隧道客户端时推荐」；写明裸 TCP（Postgres/MySQL 协议）必须靠客户端常驻
cloudflared access tcp/tailscaled这个 sidecar，Cloudflare 免费隧道不提供"任意客户端无 sidecar 直连"的公网端点（那是 Enterprise 的 Spectrum）。新增「⚠️ Vercel / serverless 特例」给出可行架构：① 在库前挂 HTTP 层（PostgREST / serverless HTTP driver，首选）② 公网 TLS + 静态出口 IP（Vercel Secure Compute，Enterprise）③ Cloudflare Spectrum。 - §5：扩展为也覆盖 serverless 连库（连接池 / serverless HTTP driver）。
- SKILL.md 路径 E 摘要同步：Vercel 走 HTTP 层，裸 TCP 隧道对它走不通。
补充一点你没展开的：Tailscale 也有同样的 sidecar 限制（Vercel serverless 跑不了常驻 tailscaled），所以根因是"无固定出口 IP + 不能跑 sidecar"——已一并写进 Vercel 特例。
review 指出:Cloudflare Tunnel 裸 TCP 需客户端常驻 `cloudflared access tcp` 代理,Vercel serverless/edge 跑不了 sidecar,照做会连不上。Tailscale 同理。 - 决策表把 Vercel/serverless 从隧道行拆出,单列指向 HTTP 层 - §2.2 改标题为"连库方能常驻隧道客户端时";补充裸 TCP 需客户端代理、 免费隧道无任意客户端直连端点(那是 Enterprise Spectrum);新增 "Vercel/serverless 特例":首选 HTTP 层,次选静态出口 IP 公网加固, 或 Spectrum - §5 扩展为也覆盖 serverless 连库(serverless HTTP driver/连接池) - SKILL.md 路径 E 摘要同步:Vercel 走 HTTP 层,裸 TCP 隧道对它走不通 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e3935789c4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| - **浏览器管理界面**：部署 **pgweb**（Postgres）或 **Adminer**（多数据库）这类 Web 管理工具。它们是 HTTP 服务，**在内网连数据库**，自己对外走 HTTPS。 | ||
| - **REST API**：部署 **PostgREST**（把 Postgres 表自动暴露成 REST API）。同样是 HTTP 服务，内网连库。 | ||
| - **serverless 连库（Vercel 等）**：用带 HTTP 入口的连接池/数据代理（PgBouncer/Supabase 之类、Prisma Accelerate、Neon/PlanetScale 这种 serverless HTTP driver），或自托管 PostgREST——让 Vercel 函数走一次 HTTPS 请求，而不是维持一条裸 TCP 长连接。 |
There was a problem hiding this comment.
For Vercel Edge/serverless callers that need an HTTP/HTTPS entrypoint, PgBouncer is not a data proxy with an HTTP API; it is a PostgreSQL connection pooler that exposes the Postgres protocol over sockets/TCP. Users following this recommendation still end up with a raw TCP endpoint, which this section says Edge/serverless clients should avoid, so PgBouncer should be removed from the HTTP-layer examples or called out separately as only useful for runtimes that can open TCP database connections.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
已采纳 👍 修复见 46727dd（已推到本 PR）。
确实自相矛盾——PgBouncer 是 Postgres wire protocol 的连接池，对外仍是裸 TCP、没有 HTTP API，放进"HTTP 层"示例会让 Vercel 用户照做后依旧拿到一个裸 TCP 端点。
改动（§2.2 Vercel 特例 + §5 两处）：
- 从 HTTP 层示例中移除 PgBouncer，改以 PostgREST 领头（自托管把 Coolify Postgres 表暴露成 HTTPS REST），保留 Prisma Accelerate 等真正基于 HTTP 的数据代理。
- 按你建议的"单独标注"，两处各补一行：PgBouncer 不是 HTTP 层，对外仍是裸 TCP，只对"能开 TCP 连接的运行时"（常驻 Node 服务 / 另一台 VPS）解决连接数问题，别拿来给 serverless 当 HTTPS 入口。
顺手还收紧了相邻一处措辞：把 Neon / PlanetScale serverless driver 框定为"本就托管在其上、自带 serverless HTTP driver 的库"，而不是"挂在自托管库前面的代理"（它们无法代理自托管 Postgres，原文这点也含糊）。
review 指出:PgBouncer 是 Postgres 协议连接池、对外仍是裸 TCP,无 HTTP API, Vercel serverless 连它一样连不上,不该列进 HTTP 层示例。 - §2.2 / §5 的 HTTP 层示例移除 PgBouncer,以 PostgREST 领头(自托管把库暴露成 HTTPS REST),保留 Prisma Accelerate 等真 HTTP 数据代理 - 两处各补一行澄清:PgBouncer 对外是裸 TCP,只对能开 TCP 的运行时(常驻 Node/ 另一台 VPS)解决连接数问题,别拿来给 serverless 当 HTTPS 入口 - 顺手收紧 Neon/PlanetScale 措辞:框定为"本就托管在其上、自带 serverless HTTP driver 的库",而非"挂在自托管库前的代理" Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
1 participant
概述
完善 coolify-ops-skill:新增数据库对外访问工作流文档、补齐
--is-public安全红线、标注未实测 CLI flag、仓库工程化,并修复 review 中发现的两处凭据泄露隐患。改动
新增文档/能力
references/database-access.md(新建) — 数据库对外访问工作流:https://db.example.com连不上,Traefik/CF 橙云只转 HTTPhttps://、带端口safety-rules.md— 🟡 新增--is-public行 + 「公开数据库端口标准流程」(先确认是否同机走内网 → 复述风险 → 仅在坚持时才公开并加固),强调永不默认公开SKILL.md— 路径 E 增加「对外访问分支」;触发 description 追加 扩容/绑域名/改 env/备份/回滚/查部署状态/暴露端口 等动词未实测 flag 标注
cli-cheatsheet.md给--save-s3/--s3-storage-uuid/--retention-amount-local、deploy list --format=json字段名加 "deploy-and-watch.shjq 字段过滤上方加核对注释安全加固(review 发现)
-s/--show-sensitive输出,连接串密码脱敏展示仓库工程化
LICENSE(MIT/2025/hifizz)、.gitignore、.github/workflows/shellcheck.yml(severity: warning, scandir ./scripts)README版本兼容声明占位 + 能做/不能做能力边界表验收
shellcheck -S warning scripts/*.sh无输出🤖 Generated with Claude Code