v0.28.0
New: Postgres Upstream DSN
Postgres support is experimental. The upstream connection is now configured as a single dsn block instead of six separate fields (host, port, sslmode, user_env, password_env, database). The DSN resolves through iron-proxy's shared secrets registry (the same sources available everywhere else: env, aws_sm, aws_ssm, 1password, 1password_connect) and is passed verbatim to pgconn.ParseConfig, so both URL and keyword/value forms are accepted.
The role field is now optional. When omitted, the proxy issues no SET ROLE and the upstream session runs as the connecting user.
Breaking change: the old six-field upstream config is no longer supported. Migrate to the dsn block before upgrading.
postgres:
- name: primary
listen: "127.0.0.1:5432"
upstream:
dsn:
type: env
var: PG_UPSTREAM_DSN
client:
user: app_user
password_env: PG_PROXY_PASSWORD
role: tenant_role # optional