|
| 1 | +# SOME DESCRIPTIVE TITLE. |
| 2 | +# Copyright (C) 1980, Joe Nelson, Steve Chavez |
| 3 | +# This file is distributed under the same license as the PostgREST package. |
| 4 | +# FIRST AUTHOR <EMAIL@ADDRESS>, 2022. |
| 5 | +# |
| 6 | +#, fuzzy |
| 7 | +msgid "" |
| 8 | +msgstr "" |
| 9 | +"Project-Id-Version: PostgREST 9.0\n" |
| 10 | +"Report-Msgid-Bugs-To: \n" |
| 11 | +"POT-Creation-Date: 1980-01-01 00:00+0000\n" |
| 12 | +"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" |
| 13 | +"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n" |
| 14 | +" Language-Team: LANGUAGE <[email protected]>\n" |
| 15 | +"MIME-Version: 1.0\n" |
| 16 | +"Content-Type: text/plain; charset=utf-8\n" |
| 17 | +"Content-Transfer-Encoding: 8bit\n" |
| 18 | +"Generated-By: Babel 2.9.0\n" |
| 19 | + |
| 20 | +#: ../../docs/admin.rst:4 |
| 21 | +msgid "Hardening PostgREST" |
| 22 | +msgstr "" |
| 23 | + |
| 24 | +#: ../../docs/admin.rst:6 |
| 25 | +msgid "" |
| 26 | +"PostgREST is a fast way to construct a RESTful API. Its default behavior " |
| 27 | +"is great for scaffolding in development. When it's time to go to " |
| 28 | +"production it works great too, as long as you take precautions. PostgREST" |
| 29 | +" is a small sharp tool that focuses on performing the API-to-database " |
| 30 | +"mapping. We rely on a reverse proxy like Nginx for additional safeguards." |
| 31 | +msgstr "" |
| 32 | + |
| 33 | +#: ../../docs/admin.rst:8 |
| 34 | +msgid "" |
| 35 | +"The first step is to create an Nginx configuration file that proxies " |
| 36 | +"requests to an underlying PostgREST server." |
| 37 | +msgstr "" |
| 38 | + |
| 39 | +#: ../../docs/admin.rst:36 |
| 40 | +msgid "" |
| 41 | +"For ubuntu, if you already installed nginx through :code:`apt` you can " |
| 42 | +"add this to the config file in :code:`/etc/nginx/sites-enabled/default`." |
| 43 | +msgstr "" |
| 44 | + |
| 45 | +#: ../../docs/admin.rst:42 |
| 46 | +msgid "Block Full-Table Operations" |
| 47 | +msgstr "" |
| 48 | + |
| 49 | +#: ../../docs/admin.rst:44 |
| 50 | +msgid "" |
| 51 | +"Each table in the admin-selected schema gets exposed as a top level " |
| 52 | +"route. Client requests are executed by certain database roles depending " |
| 53 | +"on their authentication. All HTTP verbs are supported that correspond to " |
| 54 | +"actions permitted to the role. For instance if the active role can drop " |
| 55 | +"rows of the table then the DELETE verb is allowed for clients. Here's an " |
| 56 | +"API request to delete old rows from a hypothetical logs table:" |
| 57 | +msgstr "" |
| 58 | + |
| 59 | +#: ../../docs/admin.rst:56 |
| 60 | +msgid "" |
| 61 | +"However it's very easy to delete the **entire table** by omitting the " |
| 62 | +"query parameter!" |
| 63 | +msgstr "" |
| 64 | + |
| 65 | +#: ../../docs/admin.rst:68 |
| 66 | +msgid "" |
| 67 | +"This can happen accidentally such as by switching a request from a GET to" |
| 68 | +" a DELETE. To protect against accidental operations use the `pg-" |
| 69 | +"safeupdate <https://github.com/eradman/pg-safeupdate>`_ PostgreSQL " |
| 70 | +"extension. It raises an error if UPDATE or DELETE are executed without " |
| 71 | +"specifying conditions. To install it you can use the `PGXN " |
| 72 | +"<https://pgxn.org/>`_ network:" |
| 73 | +msgstr "" |
| 74 | + |
| 75 | +#: ../../docs/admin.rst:77 |
| 76 | +msgid "" |
| 77 | +"This does not protect against malicious actions, since someone can add a " |
| 78 | +"url parameter that does not affect the result set. To prevent this you " |
| 79 | +"must turn to database permissions, forbidding the wrong people from " |
| 80 | +"deleting rows, and using `row-level security " |
| 81 | +"<https://www.postgresql.org/docs/current/ddl-rowsecurity.html>`_ if finer" |
| 82 | +" access control is required." |
| 83 | +msgstr "" |
| 84 | + |
| 85 | +#: ../../docs/admin.rst:80 |
| 86 | +msgid "Count-Header DoS" |
| 87 | +msgstr "" |
| 88 | + |
| 89 | +#: ../../docs/admin.rst:82 |
| 90 | +msgid "" |
| 91 | +"For convenience to client-side pagination controls PostgREST supports " |
| 92 | +"counting and reporting total table size in its response. As described in " |
| 93 | +":ref:`limits`, responses ordinarily include a range but leave the total " |
| 94 | +"unspecified like" |
| 95 | +msgstr "" |
| 96 | + |
| 97 | +#: ../../docs/admin.rst:90 |
| 98 | +msgid "" |
| 99 | +"However including the request header :code:`Prefer: count=exact` " |
| 100 | +"calculates and includes the full count:" |
| 101 | +msgstr "" |
| 102 | + |
| 103 | +#: ../../docs/admin.rst:98 |
| 104 | +msgid "" |
| 105 | +"This is fine in small tables, but count performance degrades in big " |
| 106 | +"tables due to the MVCC architecture of PostgreSQL. For very large tables " |
| 107 | +"it can take a very long time to retrieve the results which allows a " |
| 108 | +"denial of service attack. The solution is to strip this header from all " |
| 109 | +"requests:" |
| 110 | +msgstr "" |
| 111 | + |
| 112 | +#: ../../docs/admin.rst:107 |
| 113 | +msgid "HTTPS" |
| 114 | +msgstr "" |
| 115 | + |
| 116 | +#: ../../docs/admin.rst:109 |
| 117 | +msgid "" |
| 118 | +"PostgREST aims to do one thing well: add an HTTP interface to a " |
| 119 | +"PostgreSQL database. To keep the code small and focused we do not " |
| 120 | +"implement HTTPS. Use a reverse proxy such as NGINX to add this, `here's " |
| 121 | +"how <https://nginx.org/en/docs/http/configuring_https_servers.html>`_. " |
| 122 | +"Note that some Platforms as a Service like Heroku also add SSL " |
| 123 | +"automatically in their load balancer." |
| 124 | +msgstr "" |
| 125 | + |
| 126 | +#: ../../docs/admin.rst:112 |
| 127 | +msgid "Rate Limiting" |
| 128 | +msgstr "" |
| 129 | + |
| 130 | +#: ../../docs/admin.rst:114 |
| 131 | +msgid "" |
| 132 | +"Nginx supports \"leaky bucket\" rate limiting (see `official docs " |
| 133 | +"<https://nginx.org/en/docs/http/ngx_http_limit_req_module.html>`_). Using" |
| 134 | +" standard Nginx configuration, routes can be grouped into *request zones*" |
| 135 | +" for rate limiting. For instance we can define a zone for login attempts:" |
| 136 | +msgstr "" |
| 137 | + |
| 138 | +#: ../../docs/admin.rst:120 |
| 139 | +msgid "" |
| 140 | +"This creates a shared memory zone called \"login\" to store a log of IP " |
| 141 | +"addresses that access the rate limited urls. The space reserved, 10 MB " |
| 142 | +"(:code:`10m`) will give us enough space to store a history of 160k " |
| 143 | +"requests. We have chosen to allow only allow one request per second " |
| 144 | +"(:code:`1r/s`)." |
| 145 | +msgstr "" |
| 146 | + |
| 147 | +#: ../../docs/admin.rst:122 |
| 148 | +msgid "" |
| 149 | +"Next we apply the zone to certain routes, like a hypothetical stored " |
| 150 | +"procedure called :code:`login`." |
| 151 | +msgstr "" |
| 152 | + |
| 153 | +#: ../../docs/admin.rst:131 |
| 154 | +msgid "" |
| 155 | +"The burst argument tells Nginx to start dropping requests if more than " |
| 156 | +"five queue up from a specific IP." |
| 157 | +msgstr "" |
| 158 | + |
| 159 | +#: ../../docs/admin.rst:133 |
| 160 | +msgid "" |
| 161 | +"Nginx rate limiting is general and indiscriminate. To rate limit each " |
| 162 | +"authenticated request individually you will need to add logic in a " |
| 163 | +":ref:`Custom Validation <custom_validation>` function." |
| 164 | +msgstr "" |
| 165 | + |
| 166 | +#: ../../docs/admin.rst:138 |
| 167 | +msgid "Using External Connection Poolers" |
| 168 | +msgstr "" |
| 169 | + |
| 170 | +#: ../../docs/admin.rst:140 |
| 171 | +msgid "" |
| 172 | +"PostgREST manages its :ref:`own pool of connections <db-pool>` and uses " |
| 173 | +"prepared statements by default in order to increase performance. However," |
| 174 | +" this setting is incompatible with external connection poolers such as " |
| 175 | +"PgBouncer working in transaction pooling mode. In this case, you need to " |
| 176 | +"set the :ref:`db-prepared-statements` config option to ``false``. On the " |
| 177 | +"other hand, session pooling is fully compatible with PostgREST, while " |
| 178 | +"statement pooling is not compatible at all." |
| 179 | +msgstr "" |
| 180 | + |
| 181 | +#: ../../docs/admin.rst:144 |
| 182 | +msgid "" |
| 183 | +"If prepared statements are enabled, PostgREST will quit after detecting " |
| 184 | +"that transaction or statement pooling is being used." |
| 185 | +msgstr "" |
| 186 | + |
| 187 | +#: ../../docs/admin.rst:146 |
| 188 | +msgid "" |
| 189 | +"You should also set the :ref:`db-channel-enabled` config option to " |
| 190 | +"``false``, due to the ``LISTEN`` command not being compatible with " |
| 191 | +"transaction pooling, although it should not give any errors if it's left " |
| 192 | +"enabled by default." |
| 193 | +msgstr "" |
| 194 | + |
| 195 | +#: ../../docs/admin.rst:149 |
| 196 | +msgid "Debugging" |
| 197 | +msgstr "" |
| 198 | + |
| 199 | +#: ../../docs/admin.rst:152 |
| 200 | +msgid "Server Version" |
| 201 | +msgstr "" |
| 202 | + |
| 203 | +#: ../../docs/admin.rst:154 |
| 204 | +msgid "" |
| 205 | +"When debugging a problem it's important to verify the PostgREST version. " |
| 206 | +"At any time you can make a request to the running server and determine " |
| 207 | +"exactly which version is deployed. Look for the :code:`Server` HTTP " |
| 208 | +"response header, which contains the version number." |
| 209 | +msgstr "" |
| 210 | + |
| 211 | +#: ../../docs/admin.rst:159 |
| 212 | +msgid "Logging" |
| 213 | +msgstr "" |
| 214 | + |
| 215 | +#: ../../docs/admin.rst:161 |
| 216 | +msgid "" |
| 217 | +"PostgREST logs basic request information to ``stdout``, including the " |
| 218 | +"authenticated user if available, the requesting IP address and user " |
| 219 | +"agent, the URL requested, and HTTP response status." |
| 220 | +msgstr "" |
| 221 | + |
| 222 | +#: ../../docs/admin.rst:168 |
| 223 | +msgid "" |
| 224 | +"For diagnostic information about the server itself, PostgREST logs to " |
| 225 | +"``stderr``." |
| 226 | +msgstr "" |
| 227 | + |
| 228 | +#: ../../docs/admin.rst:180 |
| 229 | +msgid "" |
| 230 | +"When running it in an SSH session you must detach it from stdout or it " |
| 231 | +"will be terminated when the session closes. The easiest technique is " |
| 232 | +"redirecting the output to a log file or to the syslog:" |
| 233 | +msgstr "" |
| 234 | + |
| 235 | +#: ../../docs/admin.rst:189 |
| 236 | +msgid "" |
| 237 | +"PostgREST logging provides limited information for debugging server " |
| 238 | +"errors. It's helpful to get full information about both client requests " |
| 239 | +"and the corresponding SQL commands executed against the underlying " |
| 240 | +"database." |
| 241 | +msgstr "" |
| 242 | + |
| 243 | +#: ../../docs/admin.rst:192 |
| 244 | +msgid "HTTP Requests" |
| 245 | +msgstr "" |
| 246 | + |
| 247 | +#: ../../docs/admin.rst:194 |
| 248 | +msgid "" |
| 249 | +"A great way to inspect incoming HTTP requests including headers and query" |
| 250 | +" parameters is to sniff the network traffic on the port where PostgREST " |
| 251 | +"is running. For instance on a development server bound to port 3000 on " |
| 252 | +"localhost, run this:" |
| 253 | +msgstr "" |
| 254 | + |
| 255 | +#: ../../docs/admin.rst:201 |
| 256 | +msgid "" |
| 257 | +"The options to ngrep vary depending on the address and host on which " |
| 258 | +"you've bound the server. The binding is described in the " |
| 259 | +":ref:`configuration` section. The ngrep output isn't particularly pretty," |
| 260 | +" but it's legible." |
| 261 | +msgstr "" |
| 262 | + |
| 263 | +#: ../../docs/admin.rst:206 |
| 264 | +msgid "Automatic Connection Recovery" |
| 265 | +msgstr "" |
| 266 | + |
| 267 | +#: ../../docs/admin.rst:208 |
| 268 | +msgid "" |
| 269 | +"When PostgREST loses the connection to the database, it retries the " |
| 270 | +"connection using capped exponential backoff, with 32 seconds being the " |
| 271 | +"maximum backoff time." |
| 272 | +msgstr "" |
| 273 | + |
| 274 | +#: ../../docs/admin.rst:210 |
| 275 | +msgid "" |
| 276 | +"This retry behavior is triggered immediately after the connection is lost" |
| 277 | +" if :ref:`db-channel-enabled` is set to true(the default), otherwise it " |
| 278 | +"will be activated once a request is made." |
| 279 | +msgstr "" |
| 280 | + |
| 281 | +#: ../../docs/admin.rst:212 |
| 282 | +msgid "" |
| 283 | +"To notify the client when the next reconnection attempt will be, " |
| 284 | +"PostgREST responds with ``503 Service Unavailable`` and the ``Retry-" |
| 285 | +"After: x`` header, where ``x`` is the number of seconds programmed for " |
| 286 | +"the next retry." |
| 287 | +msgstr "" |
| 288 | + |
| 289 | +#: ../../docs/admin.rst:215 |
| 290 | +msgid "Database Logs" |
| 291 | +msgstr "" |
| 292 | + |
| 293 | +#: ../../docs/admin.rst:217 |
| 294 | +msgid "" |
| 295 | +"Once you've verified that requests are as you expect, you can get more " |
| 296 | +"information about the server operations by watching the database logs. By" |
| 297 | +" default PostgreSQL does not keep these logs, so you'll need to make the " |
| 298 | +"configuration changes below. Find :code:`postgresql.conf` inside your " |
| 299 | +"PostgreSQL data directory (to find that, issue the command :code:`show " |
| 300 | +"data_directory;`). Either find the settings scattered throughout the file" |
| 301 | +" and change them to the following values, or append this block of code to" |
| 302 | +" the end of the configuration file." |
| 303 | +msgstr "" |
| 304 | + |
| 305 | +#: ../../docs/admin.rst:236 |
| 306 | +msgid "" |
| 307 | +"Restart the database and watch the log file in real-time to understand " |
| 308 | +"how HTTP requests are being translated into SQL commands." |
| 309 | +msgstr "" |
| 310 | + |
| 311 | +#: ../../docs/admin.rst:240 |
| 312 | +msgid "On Docker you can enable the logs by using a custom ``init.sh``:" |
| 313 | +msgstr "" |
| 314 | + |
| 315 | +#: ../../docs/admin.rst:247 |
| 316 | +msgid "" |
| 317 | +"After that you can start the container and check the logs with ``docker " |
| 318 | +"logs``." |
| 319 | +msgstr "" |
| 320 | + |
| 321 | +#: ../../docs/admin.rst:255 |
| 322 | +msgid "Schema Reloading" |
| 323 | +msgstr "" |
| 324 | + |
| 325 | +#: ../../docs/admin.rst:257 |
| 326 | +msgid "" |
| 327 | +"Changing the schema while the server is running can lead to errors due to" |
| 328 | +" a stale schema cache. To learn how to refresh the cache see " |
| 329 | +":ref:`schema_reloading`." |
| 330 | +msgstr "" |
| 331 | + |
| 332 | +#: ../../docs/admin.rst:260 |
| 333 | +msgid "Daemonizing" |
| 334 | +msgstr "" |
| 335 | + |
| 336 | +#: ../../docs/admin.rst:262 |
| 337 | +msgid "" |
| 338 | +"For Linux distributions that use **systemd** (Ubuntu, Debian, Archlinux) " |
| 339 | +"you can create a daemon in the following way." |
| 340 | +msgstr "" |
| 341 | + |
| 342 | +#: ../../docs/admin.rst:264 |
| 343 | +msgid "First, create postgrest configuration in ``/etc/postgrest/config``" |
| 344 | +msgstr "" |
| 345 | + |
| 346 | +#: ../../docs/admin.rst:273 |
| 347 | +msgid "" |
| 348 | +"Then create the systemd service file in " |
| 349 | +"``/etc/systemd/system/postgrest.service``" |
| 350 | +msgstr "" |
| 351 | + |
| 352 | +#: ../../docs/admin.rst:288 |
| 353 | +msgid "After that, you can enable the service at boot time and start it with:" |
| 354 | +msgstr "" |
| 355 | + |
| 356 | +#: ../../docs/admin.rst:299 |
| 357 | +msgid "Alternate URL Structure" |
| 358 | +msgstr "" |
| 359 | + |
| 360 | +#: ../../docs/admin.rst:301 |
| 361 | +msgid "" |
| 362 | +"As discussed in :ref:`singular_plural`, there are no special URL forms " |
| 363 | +"for singular resources in PostgREST, only operators for filtering. Thus " |
| 364 | +"there are no URLs like :code:`/people/1`. It would be specified instead " |
| 365 | +"as" |
| 366 | +msgstr "" |
| 367 | + |
| 368 | +#: ../../docs/admin.rst:315 |
| 369 | +msgid "" |
| 370 | +"This allows compound primary keys and makes the intent for singular " |
| 371 | +"response independent of a URL convention." |
| 372 | +msgstr "" |
| 373 | + |
| 374 | +#: ../../docs/admin.rst:317 |
| 375 | +msgid "" |
| 376 | +"Nginx rewrite rules allow you to simulate the familiar URL convention. " |
| 377 | +"The following example adds a rewrite rule for all table endpoints, but " |
| 378 | +"you'll want to restrict it to those tables that have a numeric simple " |
| 379 | +"primary key named \"id.\"" |
| 380 | +msgstr "" |
| 381 | + |
0 commit comments