Documentation
¶
Overview ¶
Package config loads and validates datavase's YAML configuration.
Parsing is deliberately split from file access: Parse works on any io.Reader so the whole validation surface can be tested without touching the filesystem.
Index ¶
Constants ¶
const ( DefaultPort = 3306 DefaultTunnelPort = 22 DefaultAutoLimit = 1000 DefaultFetchChunk = 500 DefaultBufferMax = 50000 )
Default values applied when the corresponding key is absent.
Variables ¶
This section is empty.
Functions ¶
func DefaultPath ¶
DefaultPath returns the configuration file location, honouring XDG_CONFIG_HOME when it is set.
Types ¶
type Config ¶
type Config struct {
DataSources []DataSource `yaml:"datasources"`
Defaults Defaults `yaml:"defaults"`
// Keymap chooses the keyboard preset and overrides individual bindings.
// See the Keymap type for the accepted forms.
Keymap Keymap `yaml:"keymap"`
}
Config is the root of the configuration file.
func Parse ¶
Parse reads and validates YAML configuration from r.
Unknown keys are rejected rather than ignored: a typo such as "hots" would otherwise surface much later as a confusing "host is required".
type DataSource ¶
type DataSource struct {
Name string `yaml:"name"`
Env Env `yaml:"env"`
Host string `yaml:"host"`
Port int `yaml:"port"`
User string `yaml:"user"`
Database string `yaml:"database"`
Tunnel *Tunnel `yaml:"tunnel"`
// TLS is how much the connection must prove about the server. Empty means
// DefaultTLSMode for this datasource's env.
TLS TLSMode `yaml:"tls"`
// TLSCA is a PEM file of roots to verify against instead of the system
// store, for an instance behind a private certificate authority. It is
// only meaningful under a mode that verifies, and is refused under any
// other rather than read and ignored.
TLSCA string `yaml:"tls_ca"`
}
DataSource is a single MySQL/MariaDB target. Passwords are never stored here; they live in the OS keychain keyed by Name.
type Defaults ¶
type Defaults struct {
AutoLimit int `yaml:"auto_limit"`
FetchChunk int `yaml:"fetch_chunk"`
BufferMax int `yaml:"buffer_max"`
}
Defaults holds tunables shared by every datasource.
type Env ¶
type Env string
Env labels how dangerous a datasource is. The guard package keys its policy off this value, so an unrecognised label must never silently degrade into a permissive one.
type Keymap ¶
type Keymap struct {
// Preset names the keyboard to start from; empty means the default.
Preset string `yaml:"preset"`
// Actions overrides individual bindings by action name.
Actions map[string][]string `yaml:"actions"`
}
Keymap is the keyboard section of the configuration.
It carries values only. Preset names and binding syntax are the keymap package's to validate, which is what keeps configuration free of any knowledge of what a key does.
func (*Keymap) UnmarshalYAML ¶
UnmarshalYAML reads both spellings of the section.
The section began life as a bare action-to-keys mapping:
keymap: run: ["ctrl+enter", "f5"]
and gained a preset later:
keymap:
preset: vim
actions:
run: ["f5"]
Both are accepted. Rejecting the older form would silently stop applying the keys of anyone already using it, which is worse than failing to load — they would find out by pressing a key and getting nothing.
type TLSMode ¶ added in v0.2.0
type TLSMode string
TLSMode says how much the connection has to prove about the server before a credential is sent over it. The names match MySQL's own ssl-mode so that what is configured here can be checked against the server.
const ( // TLSDisabled sends everything in clear text. TLSDisabled TLSMode = "disabled" // TLSPreferred encrypts when the server offers it and silently does not // when it does not, which is why it is not enough for production. TLSPreferred TLSMode = "preferred" // TLSRequired encrypts or fails, but proves nothing about who answered. TLSRequired TLSMode = "required" // TLSVerifyCA additionally requires the certificate to chain to a trusted // root, without requiring the name on it to match the address dialled. TLSVerifyCA TLSMode = "verify-ca" // TLSVerifyIdentity additionally requires that name to match. TLSVerifyIdentity TLSMode = "verify-identity" )
func DefaultTLSMode ¶ added in v0.2.0
DefaultTLSMode is what an absent "tls:" means.
It follows env for the same reason the guard does. Production is where a credential crossing the wire in clear text costs the most, and it is also where the managed databases that refuse plain connections outright live, so "required" is both the safer default and usually the working one. Anywhere else the cost of being wrong is a connection that will not open on a developer's laptop, which is why those get "preferred".
Source Files