rcpch / rcpch-audit-engine

Epilepsy12 Audit Platform
https://e12.rcpch.ac.uk/
GNU Affero General Public License v3.0
5 stars 4 forks source link

Refresh Azure Postgres access token #1004

Closed mbarton closed 2 weeks ago

mbarton commented 2 weeks ago

Adds a manage.py command to get a new Azure Postgres access token and write it to a Postgres connection service file.

By triggering the command on a cron we can ensure that the access token is updated before expiring. This fixes an issue seen in production where Django tried to establish a new connection but the access token had expired.

mbarton commented 2 weeks ago

This doesn't work - tested in staging and it complains the password line is too long in the service file

django-1   |   File "/usr/local/lib/python3.11/site-packages/django/db/backends/postgresql/base.py", line 277, in get_new_connection                          
django-1   |     connection = self.Database.connect(**conn_params)                                                                                            
django-1   |                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^                                                                                            
django-1   |   File "/usr/local/lib/python3.11/site-packages/psycopg2/__init__.py", line 122, in connect                                                      
django-1   |     conn = _connect(dsn, connection_factory=connection_factory, **kwasync)                                                                       
django-1   |            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^                                                                       
django-1   | django.db.utils.OperationalError: line 4 too long in service file "/root/.pg_service.conf"

I will try and put it in a separate Postgres password file instead

mbarton commented 2 weeks ago

Tested this again with the password file and it's working :)

Once merged we'll need to edit the crontab on each VM manually to trigger python manage.py write_azure_pg_password_file on a schedule