package app import ( "clapclap/internal/vault" "fmt" "log" "time" "gorm.io/driver/postgres" "gorm.io/gorm" ) func (app *App) ConnectS3() { secret, err := vault.GetS3Secrets(app.Vault) if err != nil { log.Fatal(err) return } app.S3 = S3Connection(secret) app.S3Internal = S3InternalConnection(secret) } func BuildPostgresDSN(sec *vault.UserPassSecret) string { username := sec.Username password := sec.Password return fmt.Sprintf( "host=postgres port=5432 user=%s password=%s dbname=musicapp sslmode=disable", username, password, ) } func (app *App) ConnectDatabaseWithSecret(secret *vault.UserPassSecret) error { log.Printf("Connecting db\n") dsn := BuildPostgresDSN(secret) db, err := gorm.Open(postgres.Open(dsn), &gorm.Config{TranslateError: true}) if err != nil { return err } log.Printf("we are about to swap\n") old := app.SwapDB(db) if old != nil { oldDB, err := old.DB() if err == nil { go func() { oldDB.Close() }() } } log.Printf("we are swapped\n") return nil } // 2. Update your original wrapper to use the new helper func (app *App) ConnectDatabaseFromVault() error { secret, err := vault.GetDbSecrets(app.Vault) if err != nil { return err } return app.ConnectDatabaseWithSecret(secret) } func (app *App) StartDBRotation() { go func() { // var currentLease string secret, err := vault.GetDbSecrets(app.Vault) if err != nil { log.Fatal("failed to initialize DB rotation:", err) return } currentLease := secret.LeaseID for { time.Sleep(5 * time.Second) // Get() will return the cached secret UNTIL there is < 15s left, // at which point it automatically fetches a new one. secret, err := vault.GetDbSecrets(app.Vault) if err != nil { log.Println("vault error:", err) continue } // If the LeaseID changed, we have fresh credentials. Rotate the DB. if secret.LeaseID != currentLease { log.Println("New DB credentials detected. Rotating DB connection...") err := app.ConnectDatabaseWithSecret(secret) if err != nil { log.Println("db rotation failed:", err) } else { currentLease = secret.LeaseID } } } }() }