Security and Traceability on Distributed Database Systems
summary
OVHcloud faces obfuscated client IPs when using load balancers in front of PostgreSQL clusters so pg_hba.conf and logs lose source identity. The solution evaluates pgBouncer and proxy_protocol but settles on transparent HAProxy with TPROXY plus kernel routing and iptables marks to preserve original source, backed by Patroni virtual IPs for HA. It builds a routing-marking loop that restores client addresses, runs in production for two years and fixes auditability and security, at the cost of increased network complexity and harder debugging. proxy_protocol support missing in PostgreSQL Patroni-managed virtual IPs
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:38Speaker
- 1:21Critical services
- 2:16Internal databases
- 3:18Compliance
- 4:13Overview
- 4:54Cluster example at OVHcloud
- 6:49Proxies
- 7:24With proxy
- 11:19Host-based authentication
- 15:35Audit - Connections
- 16:27Audit - Disconnections
- 16:53Audit - DDL
- 20:15Application name at OVHcloud
- 21:36PgBouncer at OVHcloud
- 26:21Proxy Protocol at OVHcloud
- 31:10Transparent proxy at OVHcloud
- 32:09Conclusion
related talks
50mThe Immortal Postgres Web
57mReliability features in Postgres Pro
25mFollow my Leader connecting Postgres client applications after server failover
46mPgBouncer Connection Pooling and Routing
13mBuilding reliable infrastructure with Postgres
46mDeploying Maximum HA Architecture With Postgres
47mPostgreSQL High Availability: The Considerations and the Candidates
31mPostgreSQL Distributed & Secure Database Ecosystem Building