From a5419c20a3d48aa75a77c822cb84dff1cdff57fb Mon Sep 17 00:00:00 2001 From: Aaron Gibson Date: Sun, 4 Oct 2026 05:49:58 +0000 Subject: [PATCH] Stop giving ooniauth and oonimeasurements the Postgres URL Both tasks get POSTGRESQL_URL, the database's credentials included, and neither uses it: - ooniauth only sends login emails through SES and signs JWTs; it never opens a database session. - oonimeasurements reads ClickHouse only; it uses SQLAlchemy to build ClickHouse queries, not to connect to Postgres. That holds for master and for 636-better-pagination, which dev deploys. Checked in ooni/backend: neither service's code (outside the shared common/ package) uses PostgresDep, get_postgresql_session or settings.postgresql_url. The shared session is only built when a route asks for it, and without the variable the setting falls back to a local default. oonimeasurements' image ships the Postgres migrations, but they are only run by hand (make db-migration), with the URL read from Secrets Manager rather than from the task. The services that do use the database keep it: oonirun (OONI Run links), oonifindings (findings) and ooniprobe (VPN providers). terraform validate passes for dev and prod. Applying gives both services a task definition revision without the variable; the image is carried over from the current revision. --- tf/environments/dev/main.tf | 2 -- tf/environments/prod/main.tf | 2 -- 2 files changed, 4 deletions(-) diff --git a/tf/environments/dev/main.tf b/tf/environments/dev/main.tf index 3cdfaf40..ac1fc1f0 100644 --- a/tf/environments/dev/main.tf +++ b/tf/environments/dev/main.tf @@ -1130,7 +1130,6 @@ module "ooniapi_ooniauth" { ecs_cluster_id = module.ooniapi_cluster.cluster_id task_secrets = { - POSTGRESQL_URL = data.aws_ssm_parameter.oonipg_url.arn JWT_ENCRYPTION_KEY = data.aws_ssm_parameter.jwt_secret.arn PROMETHEUS_METRICS_PASSWORD = data.aws_ssm_parameter.prometheus_metrics_password.arn ACCOUNT_ID_HASHING_KEY = data.aws_ssm_parameter.account_id_hashing_key.arn @@ -1200,7 +1199,6 @@ module "ooniapi_oonimeasurements" { ecs_cluster_id = module.oonitier1plus_cluster.cluster_id task_secrets = { - POSTGRESQL_URL = data.aws_ssm_parameter.oonipg_url.arn JWT_ENCRYPTION_KEY = data.aws_ssm_parameter.jwt_secret.arn PROMETHEUS_METRICS_PASSWORD = data.aws_ssm_parameter.prometheus_metrics_password.arn CLICKHOUSE_URL = data.aws_ssm_parameter.clickhouse_oonimeasurements_test_url.arn diff --git a/tf/environments/prod/main.tf b/tf/environments/prod/main.tf index b8877903..328c243b 100644 --- a/tf/environments/prod/main.tf +++ b/tf/environments/prod/main.tf @@ -1358,7 +1358,6 @@ module "ooniapi_ooniauth" { service_desired_count = 2 task_secrets = { - POSTGRESQL_URL = data.aws_ssm_parameter.oonipg_url.arn JWT_ENCRYPTION_KEY = data.aws_ssm_parameter.jwt_secret.arn PROMETHEUS_METRICS_PASSWORD = data.aws_ssm_parameter.prometheus_metrics_password.arn ACCOUNT_ID_HASHING_KEY = data.aws_ssm_parameter.account_id_hashing_key.arn @@ -1431,7 +1430,6 @@ module "ooniapi_oonimeasurements" { # ecs_cluster_id = module.ooniapi_cluster.cluster_id task_secrets = { - POSTGRESQL_URL = data.aws_ssm_parameter.oonipg_url.arn JWT_ENCRYPTION_KEY = data.aws_ssm_parameter.jwt_secret.arn PROMETHEUS_METRICS_PASSWORD = data.aws_ssm_parameter.prometheus_metrics_password.arn CLICKHOUSE_URL = data.aws_ssm_parameter.clickhouse_oonimeasurements_url.arn