Migrating config to db, part 2 by j-chmielewski · Pull Request #2163 · DefGuard/defguard

j-chmielewski · 2026-03-03T04:33:09Z

Related issue: #2140

Copilot

Pull request overview

This PR continues the 2.0.0 migration of runtime configuration into the database by removing remaining config/env-based fields and adjusting startup/test/dev flows to rely on DB-backed Settings.

Changes:

Removes grpc_url from the settings DB migration and from the Settings model/config mapping.
Changes secret key generation/ensuring logic and adds config→settings mapping tests (including deriving webauthn_rp_id from defguard_url).
Updates integration tests and dev env initialization to no longer rely on default_admin_password from config.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
migrations/20260227091211_[2.0.0]_settings_in_db.up.sql	Stops adding `grpc_url` to `settings`.
migrations/20260227091211_[2.0.0]_settings_in_db.down.sql	Stops dropping `grpc_url` on rollback.
crates/defguard_core/tests/integration/common.rs	Seeds DB settings for tests (secret key + rp id) and changes `initialize_users` signature.
crates/defguard_core/tests/integration/api/common/mod.rs	Updates call site for `initialize_users`.
crates/defguard_core/tests/integration/api/acl.rs	Updates call site for `initialize_users`.
crates/defguard_core/src/lib.rs	Hardcodes dev env admin password and documents it in the header comment.
crates/defguard_core/src/enterprise/directory_sync/tests.rs	Updates admin user initialization to use a fixed password.
crates/defguard_common/src/db/models/settings.rs	Removes `grpc_url`, updates secret key generation/ensuring, refactors config mapping, and adds tests.
crates/defguard_common/src/config.rs	Removes `default_admin_password` and `grpc_url` from config.
crates/defguard/src/main.rs	Updates startup call to `Settings::ensure_secret_key` (no config param).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

crates/defguard_common/src/db/models/settings.rs

Copilot · 2026-03-03T11:43:36Z

crates/defguard_core/tests/integration/common.rs

-    User::init_admin_user(pool, config.default_admin_password.expose_secret())
-        .await
-        .unwrap();
+pub(crate) async fn initialize_users(pool: &PgPool) {


initialize_users signature changed to only take pool, but there is still at least one call site using the old (pool, &config) signature (e.g. crates/defguard_core/tests/integration/grpc/common/mod.rs:135). This will break compilation of the integration test suite unless all call sites are updated (or the old signature is retained).

Suggested change

pub(crate) async fn initialize_users(pool: &PgPool) {

pub(crate) async fn initialize_users(pool: &PgPool, _config: &DefGuardConfig) {

Copilot · 2026-03-03T11:43:37Z

crates/defguard_core/src/lib.rs


    // initialize admin user
-    User::init_admin_user(&pool, config.default_admin_password.expose_secret())
+    User::init_admin_user(&pool, "pass123")


init_dev_env now hardcodes the admin password to pass123. Since this function is callable via the InitDevEnv command, a user running it against the wrong database would create an account with a known weak password. Consider requiring an explicit password argument/flag for the subcommand, or generating a random password and printing it, rather than embedding a fixed default.

Suggested change

User::init_admin_user(&pool, "pass123")

let admin_password = std::env::var("DEFGUARD_DEV_ADMIN_PASSWORD")

.expect("Environment variable DEFGUARD_DEV_ADMIN_PASSWORD must be set to initialize the dev admin user");

User::init_admin_user(&pool, &admin_password)

Copilot · 2026-03-03T11:43:37Z

crates/defguard_common/src/config.rs

    // Certificate and key for gRPC communication over HTTPS.
    // Kept in runtime config for backwards compatibility - workers still use this.
    #[arg(long, env = "DEFGUARD_GRPC_CERT")]
    pub grpc_cert: Option<String>,
    #[arg(long, env = "DEFGUARD_GRPC_KEY")]
    pub grpc_key: Option<String>,

-    #[arg(
-        long,
-        env = "DEFGUARD_DEFAULT_ADMIN_PASSWORD",
-        default_value = "pass123"
-    )]
-    #[serde(skip_serializing)]
-    // TODO: Deprecate this, since we have initial setup now.
-    // We use it in some dev/test scenarios still so the approach will need to be changed there.
-    pub default_admin_password: SecretString,
-
    #[arg(long, env = "DEFGUARD_OPENID_KEY", value_parser = Self::parse_openid_key)]
    #[serde(skip_serializing)]
    pub openid_signing_key: Option<RsaPrivateKey>,


This change removes support for DEFGUARD_DEFAULT_ADMIN_PASSWORD in DefGuardConfig, but other repository assets still reference it (e.g. CONTRIBUTING.md and docker-compose.e2e.yaml). Please update those references (and clarify the new supported way to set the initial admin password) to avoid confusing/broken deployment and e2e setups.

…t but invalid Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

j-chmielewski added 11 commits March 3, 2026 04:31

fix tests secret key

31d63e7

remove grpc_url

84b2110

initialize webauthn_rp_id from Settings::defguard_url

8e90545

fix tests

b679011

remove stale test

5467466

move key generation from config to update_from_config

3dfdb91

harden secret key generator

1760ded

remove DefguardConfig::default_admin_password

d23b42b

cargo fmt

3f16eda

refactor update_from_config for testing

1b51270

tests

55449d6

j-chmielewski marked this pull request as ready for review March 3, 2026 07:33

j-chmielewski changed the title ~~Migration config to db 2~~ Migrating config to db, part 2 Mar 3, 2026

j-chmielewski requested a review from Copilot March 3, 2026 11:37

Copilot started reviewing on behalf of j-chmielewski March 3, 2026 11:37 View session

Copilot AI reviewed Mar 3, 2026

View reviewed changes

don't overwrite Settings::secret_key if config secret key is presen…

12c07a0

…t but invalid Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Migrating config to db, part 2#2163

Migrating config to db, part 2#2163
j-chmielewski wants to merge 12 commits intomigrationfrom
migration-config-to-db-2

j-chmielewski commented Mar 3, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI Mar 3, 2026

Uh oh!

Copilot AI Mar 3, 2026

Uh oh!

Copilot AI Mar 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	pub(crate) async fn initialize_users(pool: &PgPool) {
	pub(crate) async fn initialize_users(pool: &PgPool, _config: &DefGuardConfig) {

-    User::init_admin_user(&pool, "pass123")
+    let admin_password = std::env::var("DEFGUARD_DEV_ADMIN_PASSWORD")
+        .expect("Environment variable DEFGUARD_DEV_ADMIN_PASSWORD must be set to initialize the dev admin user");
+    User::init_admin_user(&pool, &admin_password)

Uh oh!

Conversation

j-chmielewski commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

j-chmielewski commented Mar 3, 2026 •

edited

Loading