Database Infrastructure Discovery

⚠️ 重要说明：本文档是基础设施发现记录，不是日常使用指南。

目的：
- ✅ 让团队知道有哪些数据库资源存在
- ✅ 记录连接方式和凭据存储位置
- ✅ 紧急情况下可以快速定位和访问
- ❌ 不鼓励随意连接或修改数据
- ❌ 生产操作需要经过审批流程

Internal MySQL Cluster

Known Nodes

Shared admin password: Stored in Infisical as CH4_MYSQL_ADMIN_PASSWORD and ASH3C_MYSQL_ADMIN_PASSWORD (same value)

Connection Pattern

TOKEN=$(cat ~/.infisical/token)
PASSWORD=$(infisical secrets get CH4_MYSQL_ADMIN_PASSWORD \
  --domain https://infisical.git4ta.fun \
  --projectId 7fb32203-5f5d-47cc-bca7-9cba8a9eba0e \
  --env dev \
  --token "$TOKEN" \
  --plain)

mysql -h ch4.tailnet-68f9.ts.net -P 3306 -u admin -p"$PASSWORD" --skip-ssl

Observations

• Both nodes run MySQL 9.7.0-cloud
• Same admin credentials across cluster
• Contains freshrss database (feed reader application)
• Requires --skip-ssl due to self-signed certificates

Oracle Autonomous Database (ADW/ATP/AJD/APEX)

Endpoints

Authentication

Oracle ADB admin password:

TOKEN=$(cat ~/.infisical/token)
PASSWORD=$(infisical secrets get ORACLE_ADB_ADMIN_PASSWORD \
  --domain https://infisical.git4ta.fun \
  --projectId 7fb32203-5f5d-47cc-bca7-9cba8a9eba0e \
  --env dev \
  --token "$TOKEN" \
  --plain)

Internal MySQL (ch4)

Connection Details

Authentication

MySQL admin password:

TOKEN=$(cat ~/.infisical/token)
MYSQL_PASSWORD=$(infisical secrets get CH4_MYSQL_ADMIN_PASSWORD \
  --domain https://infisical.git4ta.fun \
  --projectId 7fb32203-5f5d-47cc-bca7-9cba8a9eba0e \
  --env dev \
  --token "$TOKEN" \
  --plain)

Connection Example

TOKEN=$(cat ~/.infisical/token)
MYSQL_PASSWORD=$(infisical secrets get CH4_MYSQL_ADMIN_PASSWORD \
  --domain https://infisical.git4ta.fun \
  --projectId 7fb32203-5f5d-47cc-bca7-9cba8a9eba0e \
  --env dev \
  --token "$TOKEN" \
  --plain)

mysql -h ch4.tailnet-68f9.ts.net -P 3306 -u admin -p"$MYSQL_PASSWORD" --skip-ssl

Available Databases

• freshrss - FreshRSS feed reader data
• information_schema - MySQL metadata
• mysql - System database
• performance_schema - Performance metrics
• sys - System views

Common Patterns

Test Connectivity Before Connecting

# Oracle ADB
timeout 3 bash -c "echo > /dev/tcp/gb975f8e58e2f38-lake4.adb.us-ashburn-1.oraclecloudapps.com/27017" && echo "✓ Reachable" || echo "✗ Unreachable"

# ch4 MySQL
timeout 3 bash -c "echo > /dev/tcp/ch4.tailnet-68f9.ts.net/3306" && echo "✓ Reachable" || echo "✗ Unreachable"

Use infisical run for Process Injection

Avoid exposing passwords in process list:

TOKEN=$(cat ~/.infisical/token)
infisical run \
  --domain https://infisical.git4ta.fun \
  --projectId 7fb32203-5f5d-47cc-bca7-9cba8a9eba0e \
  --env dev \
  --token "$TOKEN" \
  -- mysql -h ch4.tailnet-68f9.ts.net -P 3306 -u admin -p"$CH4_MYSQL_ADMIN_PASSWORD" --skip-ssl

⚠️ Never hardcode the password in scripts or documentation!

Connection Examples

Connect to ADW (Korea)

TOKEN=$(cat ~/.infisical/token)
PASSWORD=$(infisical secrets get ORACLE_ADB_ADMIN_PASSWORD \
  --domain https://infisical.git4ta.fun \
  --projectId 7fb32203-5f5d-47cc-bca7-9cba8a9eba0e \
  --env dev \
  --token "$TOKEN" \
  --plain)

mongosh "mongodb://admin:${PASSWORD}@g8dfe5cebce8245-lake1.adb.ap-chuncheon-1.oraclecloudapps.com:27017/admin?authMechanism=PLAIN&authSource=\$external&ssl=true&retryWrites=false&loadBalanced=true"

Connect to AJD (US East - Recommended for speed)

TOKEN=$(cat ~/.infisical/token)
PASSWORD=$(infisical secrets get ORACLE_ADB_ADMIN_PASSWORD \
  --domain https://infisical.git4ta.fun \
  --projectId 7fb32203-5f5d-47cc-bca7-9cba8a9eba0e \
  --env dev \
  --token "$TOKEN" \
  --plain)

mongosh "mongodb://admin:${PASSWORD}@gb975f8e58e2f38-lake4.adb.us-ashburn-1.oraclecloudapps.com:27017/admin?authMechanism=PLAIN&authSource=\$external&ssl=true&retryWrites=false&loadBalanced=true"

Connection Parameters Explained

Testing Connectivity

Before connecting, test endpoint availability:

# Test TCP connectivity
timeout 3 bash -c "echo > /dev/tcp/gb975f8e58e2f38-lake4.adb.us-ashburn-1.oraclecloudapps.com/27017" && echo "✓ Connected" || echo "✗ Failed"

# Test with mongosh ping
mongosh --eval "db.adminCommand({ping: 1})" "mongodb://admin:PASSWORD@host:27017/admin?..."

Best Practices

1. Always read password from Infisical - never hardcode
2. Use process substitution to avoid password in process list:
   bash mongosh "$(infisical run --token "$TOKEN" -- echo "mongodb://admin:\${ORACLE_ADB_ADMIN_PASSWORD}@...")"
3. Choose nearest endpoint - US Ashburn endpoints tested OK from current location
4. Enable SSL - all connections must use TLS encryption
5. Use connection pooling - set maxPoolSize for production workloads

Troubleshooting

Connection timeout

• Check network routing to Oracle Cloud region
• Try alternative endpoint (Korea vs US)
• Verify firewall allows port 27017

Authentication failed

• Verify password from Infisical: infisical secrets get ORACLE_ADB_ADMIN_PASSWORD --plain
• Check authMechanism is set to PLAIN
• Ensure authSource is $external

SSL errors

• Ensure mongosh supports SSL (most builds do)
• Check certificate validation settings
• Try adding tlsAllowInvalidCertificates=true for testing (not production!)

Notes

• 找密码先来这！ 所有 Oracle ADB 连接报错 authentication failed 时，第一反应是来 Infisical 查 ORACLE_ADB_ADMIN_PASSWORD
• 韩国端点 (ap-chuncheon-1) 可能在某些网络环境下不可达，优先测试美国端点 (us-ashburn-1)
• 4个端点共享同一管理员密码，轮换时需同步更新