26 июля 2026
🔌 New pull request backend#199 Cap Prisma connection pool (PG1: shared CNPG capacity)
by: @bdtfs
## Summary
- The shared CNPG Postgres cluster (postgres-cnpg-1, max_connections=100) is running at 82-89/100 connections. compono-backend-prod alone holds 29 idle connections under role remnawave on compono_billing (verified live via pg_stat_activity, joined to pod IP 10.42.3.32).
- prisma.service.ts constructs PrismaClient with no connection_limit`/`pool_timeout override, so Prisma falls back to its default pool size formula num_physical_cpus*2+1 -- ~29 on the cluster's dedicated node, which matches the observed count exactly.
- Adds a pure buildDatabaseUrl(rawUrl, connectionLimit, poolTimeoutSeconds) helper that appends connection_limit`/`pool_timeout query params to the existing DATABASE_URL (preserving any params already present, e.g. schema=remnawave`/`sslmode, and never overriding an explicit connection_limit already in the URL) and passes the result via the constructor's datasourceUrl option.
- No change to the DATABASE_URL secret in Vault. Pool size is controlled by two new plain env vars: DATABASE_CONNECTION_LIMIT (default 10) and DATABASE_POOL_TIMEOUT (default 20). Companion ArgoCD chart PR sets DATABASE_CONNECTION_LIMIT=10 for prod, 5 for stage, via extraEnv.
## Test plan
- [x] Manually verified buildDatabaseUrl`'s query-string logic with a throwaway Node script (append when absent, preserve existing params, don't clobber an existing `connection_limit)
- [ ] This repo has no test harness at all (no test script in package.json, no jest/vitest config, zero *.spec.ts files) -- could not run this through an automated suite or CI-equivalent locally. Flagging for reviewer: please smoke-test on stage (DATABASE_CONNECTION_LIMIT=5 per the companion chart PR) and confirm `compono-backend-stage`'s live connection count drops before merging to main/prod.
Reply to this message to post a comment on GitHub.
💬 New comment on backend#199 Cap Prisma connection pool (PG1: shared CNPG capacity)
by @snyk-io[bot]
### :no_entry: Snyk checks have failed. 95 issues have been found so far.
| Status | Scan Engine |  Critical |  High |  Medium |  Low | Total (95) |
|---|---|---|---|---|---|---|
| :no_entry: | Open Source Security| 7 | 49 | 39 | 0 | 95 issues |
:computer: Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
Reply to this message to post a comment on GitHub.
💬 New comment on backend#199 Cap Prisma connection pool (PG1: shared CNPG capacity)
by @bdtfs
Opened against the wrong repo by mistake (gh CLI resolved this fork's origin remote to the upstream repo instead of compono-vpn/compono-backend). Closing -- re-opening against the correct internal fork.
Reply to this message to post a comment on GitHub.
💬 New comment on backend#199 Cap Prisma connection pool (PG1: shared CNPG capacity)
by @greptile-apps[bot]
<h3>Greptile Summary</h3>
This PR substantially expands beyond the stated database-pool cap:
- Caps Prisma connections by adding connection_limit and pool_timeout URL parameters.
- Adds node user-observation and reconciliation APIs, repository queries, metrics, and tests.
- Adds host-level Reality, flow, and transport overrides with a database migration and subscription rendering support.
- Replaces the release workflows and Docker build with a Compono-specific GHCR and ArgoCD pipeline.
- Allows private 10/8 peers to bypass reverse-proxy header enforcement and adds an active-VLESS-UUID endpoint.
<h3>Confidence Score: 2/5</h3>
This PR is not safe to merge until cross-inbound reconciliation stops globally deleting still-entitled users and both pull-request and manual workflow paths execute correctly.
A normal partial squad-membership change can repeatedly remove valid node access, while the only CI workflow skips its build on pull requests and ignores the required tag during manual dispatch.
Files Needing Attention: src/modules/nodes/nodes.service.ts, .github/workflows/build-and-push.yml
<h3>Important Files Changed</h3>
| Filename | Overview |
|----------|----------|
| src/modules/nodes/nodes.service.ts | Adds node-state observation and reconciliation, but global deletion of users found stale on one inbound can remove still-valid access on sibling inbounds. |
| src/modules/nodes/repositories/nodes.repository.ts | Adds expected-user and credential queries that derive per-node inbound membership from active users and squad mappings. |
| src/modules/nodes/utils/reconcile-diff.ts | Implements deterministic per-tag reconciliation and safety-cap logic, although the mutation layer does not preserve its tag granularity for removals. |
| src/common/database/prisma.service.ts | Adds default connection-limit and pool-timeout parameters while preserving explicit U
Ответсообщение недоступно
☠️ TryRemnawave instance has been terminated.
🪪 Instance ID: 5f7d...698d
🟢 0/25
💬 New comment on subscription-page#54 feat: add Cheezy account hub
by @greptile-apps[bot]
<h3>Greptile Summary</h3>
Adds an opt-in Cheezy account-management hub to subscription pages.
- Introduces OAuth/PKCE login, session and CSRF cookies, subscription attachment, transfer, renewal, and logout BFF endpoints.
- Adds the account widget and localized account-management UI.
- Adds Cheezy configuration validation, documentation, sample environment values, and URL-redacting access logging.
<h3>Confidence Score: 2/5</h3>
The PR is not safe to merge until client-specific paths, configured route prefixes, and subscription identifier logging are handled correctly.
Supported client-specific URLs send the wrong subscription identifier to the account API, prefixed deployments cannot reach the hard-coded account endpoints, and two-segment subscription URLs remain unredacted in access logs.
Files Needing Attention: backend/src/main.ts, backend/src/modules/root/account-hub.controller.ts, frontend/src/widgets/main/account-hub/account-hub.widget.tsx
<details open><summary><h3>Security Review</h3></summary>
Client-specific subscription paths are not matched by the new log-redaction expression, so their short subscription identifiers remain exposed in access logs.
</details>
<h3>Important Files Changed</h3>
| Filename | Overview |
|----------|----------|
| backend/src/modules/root/account-hub.controller.ts | Adds the account BFF and OAuth flow, but generated account URLs do not honor the configured global prefix. |
| frontend/src/widgets/main/account-hub/account-hub.widget.tsx | Adds account-management UI, but misidentifies subscriptions on client-specific routes and hard-codes unprefixed BFF endpoints. |
| backend/src/main.ts | Adds access-log URL redaction, but supported two-segment subscription paths still expose their identifiers. |
| backend/src/common/config/app-config/config.schema.ts | Adds opt-in Cheezy configuration with a false default and conditional validati
Ответсообщение недоступно
🦋 TryRemnawave instance just got deployed.
🪪 Instance ID: 0653...13e0
🆔 User ID: 1*********
⌛ Deployed in 2 minutes.
🟢 1/25
Ответсообщение недоступно
☠️ TryRemnawave instance has been terminated.
🪪 Instance ID: 0653...13e0
🟢 0/25
Ответсообщение недоступно
🦋 TryRemnawave instance just got deployed.
🪪 Instance ID: a527...e04f
🆔 User ID: 5*********
⌛ Deployed in 2 minutes.
🟢 1/25
Ответсообщение недоступно
☠️ TryRemnawave instance has been terminated.
🪪 Instance ID: a527...e04f
🟢 0/25